vmalert: compress each vmrule independently

[AndrewChubatiuk]

fixes #2610

store compressed vmrule content in bucket as . key, which prevents from groups recreation in vmalert

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.

Fix all with cubic | Re-trigger cubic</sub>

[AndrewChubatiuk]

@cubic-ai-dev

[cubic-dev-ai]

@cubic-ai-dev

@AndrewChubatiuk I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[AndrewChubatiuk]

@cubic-ai-dev

[cubic-dev-ai]

@cubic-ai-dev

@AndrewChubatiuk I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 11 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[AndrewChubatiuk]

@cubic-ai-dev

[cubic-dev-ai]

@cubic-ai-dev

@AndrewChubatiuk I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 11 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

3 issues found across 11 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/controller/operator/factory/vmagent/vmagent.go">

<violation number="1" location="internal/controller/operator/factory/vmagent/vmagent.go:1419">
P2: When a VMAgent has no scrape jobs, this call skips the marshal-size check entirely, so a large `cfgBase` can produce a main Secret larger than `ConfigDataBudgetBytes` without an error. Measure the base-only configuration on the empty-job path before reconciling the Secret.</violation>
</file>

<file name="internal/controller/operator/factory/vmagent/vmagent_test.go">

<violation number="1" location="internal/controller/operator/factory/vmagent/vmagent_test.go:3480">
P2: When the main Secret is missing, this non-fatal assertion leaves `secret` empty and the following size check passes with length zero. Return after a failed `Get` (or use a fatal assertion) before validating the compressed data.</violation>

<violation number="2" location="internal/controller/operator/factory/vmagent/vmagent_test.go:3488">
P2: TestCreateOrUpdateScrapeConfig_CompressibleBaseConfigDoesNotHardFail never exercises the budget/measurement path: with no scrape objects, jobs is empty, and PackItemsFunc short-circuits (`len(items) == 0`) before calling the measuring closure, so the assertion passes trivially and cannot catch a regression in compressible-base handling. Add at least one VMServiceScrape so the packing/measurement logic actually runs.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: When a VMAgent has no scrape jobs, this call skips the marshal-size check entirely, so a large cfgBase can produce a main Secret larger than ConfigDataBudgetBytes without an error. Measure the base-only configuration on the empty-job path before reconciling the Secret.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/controller/operator/factory/vmagent/vmagent.go, line 1419:

<comment>When a VMAgent has no scrape jobs, this call skips the marshal-size check entirely, so a large `cfgBase` can produce a main Secret larger than `ConfigDataBudgetBytes` without an error. Measure the base-only configuration on the empty-job path before reconciling the Secret.</comment>

<file context>
@@ -1415,12 +1415,28 @@ func createOrUpdateScrapeConfig(ctx context.Context, rclient client.Client, cr,
-	// Split jobs into gzip-compressed buckets, each fitting within the Kubernetes Secret limit.
-	buckets, err := build.PackItems(jobs, cfg.ConfigDataBudgetBytes, 150)
+	// measures the real stored bytes (cfgBase+glob+wrapper), glob assumed present as a safe overestimate
+	mainBuckets, err := build.PackItemsFunc(jobs, cfg.ConfigDataBudgetBytes, func(candidate []yaml.MapSlice) ([]byte, error) {
+		mainCfg := append(append(yaml.MapSlice{}, cfgBase...), yaml.MapItem{
+			Key:   "scrape_config_files",
</file context>

[cubic-dev-ai]

P2: When the main Secret is missing, this non-fatal assertion leaves secret empty and the following size check passes with length zero. Return after a failed Get (or use a fatal assertion) before validating the compressed data.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/controller/operator/factory/vmagent/vmagent_test.go, line 3480:

<comment>When the main Secret is missing, this non-fatal assertion leaves `secret` empty and the following size check passes with length zero. Return after a failed `Get` (or use a fatal assertion) before validating the compressed data.</comment>

<file context>
@@ -3421,3 +3423,93 @@ func TestMakeSpecForAgentOk_WatchTargetDirPairing(t *testing.T) {
+	}
+
+	var secret corev1.Secret
+	assert.NoError(t, fclient.Get(ctx, types.NamespacedName{
+		Name:      build.ResourceName(build.SecretConfigResourceKind, cr),
+		Namespace: cr.Namespace,
</file context>

Suggested change

	assert.NoError(t, fclient.Get(ctx, types.NamespacedName{
	Name: build.ResourceName(build.SecretConfigResourceKind, cr),
	Namespace: cr.Namespace,
	}, &secret))
	if !assert.NoError(t, fclient.Get(ctx, types.NamespacedName{
	Name: build.ResourceName(build.SecretConfigResourceKind, cr),
	Namespace: cr.Namespace,
	}, &secret)) {
	return
	}

[cubic-dev-ai]

P2: TestCreateOrUpdateScrapeConfig_CompressibleBaseConfigDoesNotHardFail never exercises the budget/measurement path: with no scrape objects, jobs is empty, and PackItemsFunc short-circuits (len(items) == 0) before calling the measuring closure, so the assertion passes trivially and cannot catch a regression in compressible-base handling. Add at least one VMServiceScrape so the packing/measurement logic actually runs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/controller/operator/factory/vmagent/vmagent_test.go, line 3488:

<comment>TestCreateOrUpdateScrapeConfig_CompressibleBaseConfigDoesNotHardFail never exercises the budget/measurement path: with no scrape objects, jobs is empty, and PackItemsFunc short-circuits (`len(items) == 0`) before calling the measuring closure, so the assertion passes trivially and cannot catch a regression in compressible-base handling. Add at least one VMServiceScrape so the packing/measurement logic actually runs.</comment>

<file context>
@@ -3421,3 +3423,93 @@ func TestMakeSpecForAgentOk_WatchTargetDirPairing(t *testing.T) {
+		"main config secret must not exceed ConfigDataBudgetBytes once cfgBase is included")
+}
+
+func TestCreateOrUpdateScrapeConfig_CompressibleBaseConfigDoesNotHardFail(t *testing.T) {
+	ctx := context.Background()
+	cr := &vmv1beta1.VMAgent{
</file context>