Report top-level owners for pods

For each pod, report the top-level owner resources for those pods,
that is, the transitive owners which are not owned by any other
resources. Note that a pod may have more than one owner, and therefore
it can also have more than one top-level owner.

Update the `kube` crate to version 1.1.0 and the `k8s-openapi` crate
to version `0.25.0`. Use the "earliest" feature instead of "latest"
to support most API server versions, though there is no significant
difference in support regardless.

Update the Rust version to 1.82.0 to be able to use a recent version
of the `kube` crate.

Implement a cache for ownership resolution and API discovery. The
discovery results are kept between runs, but can be refreshed if
resources from new APIs are referenced. The ownership cache is reset
during each run, as the ownership relationships can change at any
time.

Improve trace logging. Do not `panic!` when AppSignal or Kubernetes
are unreachable.

Update the deployment YAML to provide read-only permissions to all
API groups and resources -- this is necessary due to the owner
traversal logic needing to be able to retrieve arbitrary resources.

Update the deployment YAML for Helm as well, and fix the version
updating script to update the version number on it as well.

Author: unflxw

Cargo.lock

@@ -8,8 +8,8 @@ edition = "2021"
 [dependencies]
 tokio = { version = "1", default-features = false, features = ["macros", "rt-multi-thread", "time"] }
 serde_json = "1.0"
-kube = { version = "0.89", features = ["runtime", "derive"] }
-k8s-openapi = { version = "0.21", features = ["latest"] }
+kube = { version = "1.1.0", features = ["runtime", "derive"] }
+k8s-openapi = { version = "0.25", features = ["earliest"] }
 http = "1.0"
 serde = "*"
 protobuf = "=2.24.1"

Cargo.toml

@@ -15,14 +15,16 @@ spec:
       serviceAccountName: appsignal-kubernetes-service-account
       containers:
       - name: appsignal-kubernetes
-        image: appsignal/appsignal-kubernetes:1.0.0
+        image: appsignal/appsignal-kubernetes:1.1.2
         imagePullPolicy: IfNotPresent
         env:
         - name: APPSIGNAL_API_KEY
           valueFrom:
             secretKeyRef:
               name: appsignal
               key: api-key
+        - name: RUST_LOG
+          value: info
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -34,10 +36,8 @@ kind: ClusterRole
 metadata:
   name: appsignal-kubernetes-role
 rules:
-  - apiGroups: [""]
-    resources:
-      - nodes
-      - "nodes/proxy"
+  - apiGroups: ["*"]
+    resources: ["*"]
     verbs:
       - get
       - list

charts/appsignal-kubernetes/templates/deployment.yaml

@@ -36,11 +36,8 @@ kind: ClusterRole
 metadata:
   name: appsignal-kubernetes-role
 rules:
-  - apiGroups: [""]
-    resources:
-      - nodes
-      - "nodes/proxy"
-      - pods
+  - apiGroups: ["*"]
+    resources: ["*"]
     verbs:
       - get
       - list