feat(api): filter Pod exports by container age by AlexVulaj · Pull Request #23828 · stackrox/stackrox

AlexVulaj · 2026-11-02T19:37:06Z

Description

For a feasibility demo/proof-of-concept related to ROX-37259 . Adds min_container_age_days to /v1/export/pods. A Pod matches when any live, unfinished container instance started at least that many 24-hour days ago. Zero disables the filter; negative values are invalid. Matching Pods are exported whole, including younger containers.

The service applies the age check after the existing query, avoiding a new index or scheduler. Query and timeout behavior remain in effect.

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

How I validated my change

No filter and zero return the same Pod count.

$ roxcurl /v1/export/pods | jq -n 'reduce inputs as $r (0; . + (if $r.result.pod then 1 else 0 end))'
138
$ roxcurl /v1/export/pods -G --data-urlencode 'minContainerAgeDays=0' | jq -n 'reduce inputs as $r (0; . + (if $r.result.pod then 1 else 0 end))'
138

Before 24 hours, the one-day filter returned no Pods.

$ roxcurl /v1/export/pods -G --data-urlencode 'minContainerAgeDays=1' | jq -n 'reduce inputs as $r (0; . + (if $r.result.pod then 1 else 0 end))'
0

A negative age was rejected.

$ roxcurl /v1/export/pods -G --data-urlencode 'minContainerAgeDays=-1' -i
HTTP/2 400
{"error":{"code":3,"message":"min_container_age_days must be non-negative: invalid arguments","details":[]}}

The newly created Pod appeared in the unfiltered export.

$ NS=pod-age-test-1793742149
$ roxcurl /v1/export/pods | jq -r --arg ns "$NS" '.result.pod | select(.namespace == $ns) | [.namespace, .name, (.liveInstances[0].started // "no start time")] | @tsv'
pod-age-test-1793742149	young-probe-845f86598-zl9cq	2026-11-03T21:43:54Z

After 24 hours, the fleet-wide filter found older Pods but excluded the new Pod.

$ roxcurl /v1/export/pods -G --data-urlencode 'minContainerAgeDays=1' |
  jq -n --arg ns "$NS" '
    reduce inputs as $r ({olderPods: 0, newNamespacePods: 0};
      if $r.error then error($r.error | tostring)
      elif $r.result.pod then
        .olderPods += 1
        | .newNamespacePods += (if $r.result.pod.namespace == $ns then 1 else 0 end)
      else . end
    )
  '
{
  "olderPods": 133,
  "newNamespacePods": 0
}

A namespace query found the new Pod; adding the age filter excluded it.

$ roxcurl /v1/export/pods -G --data-urlencode "query=Namespace:${NS}" | jq -r '.result.pod | [.namespace, .name] | @tsv'
pod-age-test-1793742149	young-probe-845f86598-zl9cq

$ roxcurl /v1/export/pods -G --data-urlencode "query=Namespace:${NS}" --data-urlencode 'minContainerAgeDays=1' | jq -n 'reduce inputs as $r (0; . + (if $r.result.pod then 1 else 0 end))'
0

openshift-ci · 2026-11-02T19:37:10Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

coderabbitai · 2026-11-02T19:40:04Z

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

New Features
- Pod exports can now be filtered by minimum container age, alongside an optional namespace query. When enabled, a pod is included if it has a live container instance that meets the age threshold; its live instances are retained in the export.
Bug Fixes
- Invalid negative age values are rejected instead of being used for filtering.

ExportPodRequest adds a minimum container age. ExportPods rejects negative values and filters Pods by live instance start time when the value is positive. Tests cover filtering, namespace queries, and invalid values.

Changes: Pod export age filter

Layer / File(s)	Summary
Request field and export filtering `proto/api/v1/pod_service.proto`, `central/pod/service/service_impl.go`, `central/pod/service/service_impl_export_test.go`	`ExportPodRequest` adds `min_container_age_days`. `ExportPods` applies the age filter for positive values and returns `InvalidArgs` for negative values. Tests cover unfiltered exports, age and namespace filtering, and retained live instances.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: Minimal · up to 3ccdd

No actionable merge-blocking risk was identified; normal checks remain appropriate.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title "feat(api): filter Pod exports by container age" matches the main change. The PR adds a min_container_age_days filter to the /v1/export/pods API, and the summary shows the service, proto, an…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description states the purpose: a feasibility demo/proof of concept that adds `min_container_age_days` to `/v1/export/pods`, with the matching rule, zero/negative handling, and the choice to filte…

Full details: Title check

Explanation

The title "feat(api): filter Pod exports by container age" matches the main change. The PR adds a min_container_age_days filter to the /v1/export/pods API, and the summary shows the service, proto, and test changes that implement it. The title is specific and follows a conventional commit style.

Full details: Description check

Explanation

The description states the purpose: a feasibility demo/proof of concept that adds min_container_age_days to /v1/export/pods, with the matching rule, zero/negative handling, and the choice to filter after the existing query. It includes validation output for the zero case, the one-day case, the negative case, and a namespace query. Changelog and documentation boxes are checked. Testing boxes show unit tests added, with e2e, regression, and compatibility tests unchecked. The template's 'change me!' placeholders were replaced, so the description is mostly complete.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

Commit to this branch
Create a new PR

Generate unit tests (beta)

Commit to this branch
Create a new PR

Warning

Some tools did not complete. Review the errors below.

Buf (1.73.0)

proto/api/v1/pod_service.proto

fatal: unable to access 'https://github.com/stackrox/stackrox.git/': Failed to connect to github.com:443 over proxy 127.0.0.1 after 0 ms: Could not connect to server
fatal: could not fetch 0b32b0ca1b95d3edabf68bb1ba792bdd164ba872 from promisor remote

CODERABBIT_BUF_COMPATIBILITY_PHASE=materialize-base

CodeRabbit Verify

Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

Source mode: Auto

Repository: Unavailable

Branch: Unavailable

File: No configuration file from this repository applied

Commit: Unavailable

Layers: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: `8f35542e-8685-4eac-9760-4b658b5c6f7c`

Commits

Reviewing files that changed from the base of the PR and between `49be202` and `3ccdd02`.

Files ignored due to path filters: 3

`generated/api/v1/pod_service.pb.go` is excluded by `!**/*.pb.go`, `!/generated/`

`generated/api/v1/pod_service.swagger.json` is excluded by `!/generated/`

`generated/api/v1/pod_service_vtproto.pb.go` is excluded by `!**/*.pb.go`, `!/generated/`

Files selected for processing: 3

`central/pod/service/service_impl.go`

`central/pod/service/service_impl_export_test.go`

`proto/api/v1/pod_service.proto`

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

github-actions · 2026-11-02T19:46:36Z

🚀 Build Images Ready

Images are ready for commit 3ccdd02. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.1.x-446-g3ccdd023b9

codecov · 2026-11-02T20:01:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.58%. Comparing base (7691187) to head (3ccdd02).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #23828      +/-   ##
==========================================
- Coverage   52.66%   52.58%   -0.08%     
==========================================
  Files        2833     2836       +3     
  Lines      177733   177983     +250     
==========================================
- Hits        93605    93596       -9     
- Misses      75937    76174     +237     
- Partials     8191     8213      +22

Flag	Coverage Δ
go-unit-tests	`52.58% <100.00%> (-0.08%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

feat(api): filter Pod exports by container age

3ccdd02

openshift-ci Bot added the do-not-merge/work-in-progress label Nov 2, 2026

github-actions Bot added the area/central label Nov 2, 2026

AlexVulaj self-assigned this Nov 3, 2026

Navigation Menu

Repository navigation

feat(api): filter Pod exports by container age - #23828

feat(api): filter Pod exports by container age#23828
AlexVulaj wants to merge 1 commit into
masterfrom
AlexVulaj/pod-export-min-age

AlexVulaj commented Nov 2, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Nov 2, 2026

Uh oh!

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

codecov Bot commented Nov 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

AlexVulaj commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

openshift-ci Bot commented Nov 2, 2026

Uh oh!

coderabbitai Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

CodeRabbit Verify

Uh oh!

github-actions Bot commented Nov 2, 2026

🚀 Build Images Ready

Uh oh!

codecov Bot commented Nov 2, 2026

Codecov Report

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

AlexVulaj commented Nov 2, 2026 •

edited

Loading

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading