fix(kubeapiserver): validate group resource strings to support groups with periods

comp/core/workloadmeta/collectors/internal/kubeapiserver/kubeapiserver_test.go

@@ -469,10 +469,22 @@ func TestResourcesWithMetadataCollectionEnabled(t *testing.T) {
 				"language_detection.reporting.enabled":             false,
 				"cluster_agent.kube_metadata_collection.enabled":   false,
 				"cluster_agent.kube_metadata_collection.resources": "",
-				"kubernetes_resources_labels_as_tags":              `{"deployments.apps": {"x-team": "team"}}`,
+				"kubernetes_resources_labels_as_tags":              `{"deployments.apps": {"x-team": "team"}, "custom.example.com": {"x-team": "team"}}`,
 				"kubernetes_resources_annotations_as_tags":         `{"namespaces": {"x-team": "team"}}`,
 			},
-			expectedResources: []string{"//nodes", "//namespaces"},
+			expectedResources: []string{"//nodes", "//namespaces", "example.com//custom"},
+		},
+		{
+			name: "generic resources tagging should be exclude invalid resources",
+			cfg: map[string]interface{}{
+				"language_detection.enabled":                       false,
+				"language_detection.reporting.enabled":             false,
+				"cluster_agent.kube_metadata_collection.enabled":   false,
+				"cluster_agent.kube_metadata_collection.resources": "",
+				"kubernetes_resources_labels_as_tags":              `{"-invalid": {"x-team": "team"}, "invalid.exa_mple.com": {"x-team": "team"}}`,
+				"kubernetes_resources_annotations_as_tags":         `{"in valid.example.com": {"x-team": "team"}, "invalid.example.com-": {"x-team": "team"}}`,
+			},
+			expectedResources: []string{"//nodes"},
 		},
 		{
 			name: "deployments should be excluded from metadata collection",
@@ -497,9 +509,9 @@ func TestResourcesWithMetadataCollectionEnabled(t *testing.T) {
 			name: "resources explicitly requested",
 			cfg: map[string]interface{}{
 				"cluster_agent.kube_metadata_collection.enabled":   true,
-				"cluster_agent.kube_metadata_collection.resources": "apps/deployments apps/statefulsets",
+				"cluster_agent.kube_metadata_collection.resources": "apps/deployments apps/statefulsets example.com/custom",
 			},
-			expectedResources: []string{"//nodes", "apps//statefulsets"},
+			expectedResources: []string{"//nodes", "apps//statefulsets", "example.com//custom"},
 		},
 		{
 			name: "namespaces needed for namespace labels as tags",

comp/core/workloadmeta/collectors/internal/kubeapiserver/utils.go

@@ -14,6 +14,7 @@ import (
 	"strings"
 
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/client-go/discovery"
 
 	"github.com/DataDog/datadog-agent/pkg/util/log"
@@ -25,19 +26,17 @@ import (
 // a group version resource string is in the form `{group}/{version}/{resource}` (example: apps/v1/deployments)
 // if the groupResource argument is not in the correct format, an empty string is returned
 func groupResourceToGVRString(groupResource string) string {
-	parts := strings.Split(groupResource, ".")
-
-	if len(parts) > 2 {
-		// incorrect format
-		log.Errorf("unexpected group resource format %q. correct format should be `{resource}.{group}` or `{resource}`", groupResource)
-	} else if len(parts) == 1 {
+	if len(validation.IsDNS1123Label(groupResource)) == 0 {
 		// format is `{resource}`
-		return parts[0]
-	} else {
-		// format is `{resource}/{group}`
-		return fmt.Sprintf("%s//%s", parts[1], parts[0])
+		return groupResource
+	} else if len(validation.IsDNS1123Subdomain(groupResource)) == 0 {
+		resource, group, _ := strings.Cut(groupResource, ".")
+		// format is `{group}/{version}/{resource}`
+		return fmt.Sprintf("%s//%s", group, resource)
 	}
 
+	// invalid group resource format
+	log.Errorf("invalid group resource %q. must be a valid RFC1123 subdomain in the format `{resource}.{group}` or `{resource}`", groupResource)
 	return ""
 }
 

releasenotes/notes/Fix-parsing-of-group-resource-strings-a0d2897fc728de26.yaml

@@ -0,0 +1,11 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+fixes:
+  - |
+    Fixed parsing of group resource strings to support groups with periods.