fix(scan): reach auto-detected Prometheus/OpenCost via the API server proxy

scan runs on the user's machine, but auto-detection returned an in-cluster
Service DNS name (*.svc) that only resolves inside the cluster. Every query
failed with "no such host" and the scan silently reported a misleading
100/100 $0 (zero usage mistaken for zero waste) — hit on a real cluster.

- Reach an auto-detected Prometheus/OpenCost through the Kubernetes API server
  proxy (/api/v1/namespaces/<ns>/services/<svc>:<port>/proxy), reusing the
  kubeconfig's API server address + credentials. Works wherever kubectl works,
  no port-forward.
- Validate reachability (a trivial `up` query / live allocation fetch) before
  committing to Tier 1 / Tier 2; an unreachable endpoint falls back to the
  operator / metrics-server / derived pricing with a clear note.
- Expose kube.Clients.RESTConfig; add DetectPrometheusEndpoint /
  DetectOpenCostEndpoint (+ struct), NewPrometheusProviderViaAPIProxy,
  NewOpenCostProviderViaAPIProxy, and usage.Reachable. Auto-detect now sits
  behind provider seams (prometheusAutoProvider / openCostAutoProvider).
- An explicit --prometheus-url / --opencost-url is still used directly.

Author: mayur-tolexo

CHANGELOG.md

@@ -7,6 +7,17 @@ fixes/UX).
 
 ## [Unreleased]
 
+### Fixed
+- **Auto-detected Prometheus/OpenCost now reachable from `scan`.** Detection returned an
+  in-cluster Service DNS name (`*.svc`) that doesn't resolve on the user's machine, so every
+  query failed with "no such host" and the scan silently reported a misleading `100/100, $0`.
+  `scan` now reaches an auto-detected Prometheus or OpenCost through the **Kubernetes API server
+  proxy** (reusing the kubeconfig's address + credentials — works wherever kubectl works, no
+  port-forward), and **validates reachability** before committing to Tier 1/Tier 2; an
+  unreachable endpoint falls back to the operator / metrics-server / derived pricing with a clear
+  note instead of producing empty results. An explicit `--prometheus-url` / `--opencost-url` is
+  still used directly.
+
 ### Added
 - **`kubetidy init --with-opencost`** — deploy a complete Tier-2 cost stack into the cluster from
   embedded manifests, so scans get precise allocated cost out of the box. OpenCost needs

README.md

@@ -200,7 +200,12 @@ See [docs/design/operator.md](docs/design/operator.md) for the design.
 ## High-confidence scans with Prometheus (Tier 1)
 
 Already run Prometheus? kubetidy auto-detects the common in-cluster service names, so plain
-`kubectl tidy scan` upgrades to Tier 1 automatically. Or point it explicitly:
+`kubectl tidy scan` upgrades to Tier 1 automatically. Because `scan` runs on your machine (where
+in-cluster Service DNS doesn't resolve), it reaches an auto-detected Prometheus — and OpenCost —
+**through the Kubernetes API server proxy**, reusing your kubeconfig's credentials: no
+port-forward, works wherever `kubectl` works. It validates the endpoint answers before using it,
+so a detected-but-unreachable service falls back cleanly instead of reporting empty results. Or
+point it explicitly (used as-is, e.g. a `localhost` port-forward):
 
 ```sh
 kubectl tidy scan --prometheus-url http://prometheus.monitoring.svc:9090

internal/cli/orchestration_test.go

@@ -14,13 +14,14 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	dynfake "k8s.io/client-go/dynamic/fake"
-	"k8s.io/client-go/kubernetes"
 	kfake "k8s.io/client-go/kubernetes/fake"
 	mfake "k8s.io/metrics/pkg/client/clientset/versioned/fake"
 
 	"github.com/kubetidy/kubetidy/internal/apis/usageprofile"
 	"github.com/kubetidy/kubetidy/internal/kube"
 	"github.com/kubetidy/kubetidy/internal/model"
+	"github.com/kubetidy/kubetidy/internal/pricing"
+	"github.com/kubetidy/kubetidy/internal/usage"
 )
 
 func orchInt32(v int32) *int32 { return &v }
@@ -129,13 +130,21 @@ func TestSelectUsageProviderBadPrometheusFallsBack(t *testing.T) {
 }
 
 func TestSelectUsageProviderAutoDetect(t *testing.T) {
-	svc := &corev1.Service{
-		ObjectMeta: metav1.ObjectMeta{Name: "prometheus-server", Namespace: "monitoring"},
-		Spec:       corev1.ServiceSpec{Ports: []corev1.ServicePort{{Port: 80}}},
+	// Override the auto-detect seam to return a reachable Prometheus provider, as it would in a
+	// cluster where the API-server-proxy endpoint answers. (The real seam routes through the
+	// proxy + validates reachability, which needs a live cluster.)
+	orig := prometheusAutoProvider
+	defer func() { prometheusAutoProvider = orig }()
+	prometheusAutoProvider = func(_ *kube.Clients, window string) (usage.Provider, string, bool) {
+		p, err := usage.NewPrometheusProvider("http://prom.test:9090", window)
+		if err != nil {
+			t.Fatalf("building test prometheus provider: %v", err)
+		}
+		return p, "monitoring/prometheus-server:80 via the API server proxy", true
 	}
-	clients := &kube.Clients{Kube: kfake.NewSimpleClientset(svc), Metrics: mfake.NewSimpleClientset()}
+
 	var warnings []string
-	p := selectUsageProvider(clients, &scanFlags{window: "14d"}, &warnings)
+	p := selectUsageProvider(orchFakeClients(t), &scanFlags{window: "14d"}, &warnings)
 	if p.Name() != "prometheus" {
 		t.Errorf("provider = %q, want auto-detected prometheus", p.Name())
 	}
@@ -144,6 +153,25 @@ func TestSelectUsageProviderAutoDetect(t *testing.T) {
 	}
 }
 
+func TestSelectUsageProviderUnreachablePromFallsBack(t *testing.T) {
+	// A detected-but-unreachable Prometheus must fall through (here, to metrics-server) and leave
+	// a fall-back note, rather than committing to an empty Tier 1.
+	orig := prometheusAutoProvider
+	defer func() { prometheusAutoProvider = orig }()
+	prometheusAutoProvider = func(_ *kube.Clients, _ string) (usage.Provider, string, bool) {
+		return nil, "found Prometheus service monitoring/prometheus-server but it did not answer queries; falling back to operator/metrics-server", false
+	}
+
+	var warnings []string
+	p := selectUsageProvider(orchFakeClients(t), &scanFlags{window: "14d"}, &warnings)
+	if p.Name() != "metrics-server" {
+		t.Errorf("provider = %q, want metrics-server fallback", p.Name())
+	}
+	if !strings.Contains(strings.Join(warnings, " "), "did not answer") {
+		t.Errorf("warnings = %v, want a fall-back note", warnings)
+	}
+}
+
 func TestSelectUsageProviderDefaultMetricsServer(t *testing.T) {
 	var warnings []string
 	p := selectUsageProvider(orchFakeClients(t), &scanFlags{window: "14d"}, &warnings)
@@ -248,10 +276,17 @@ func TestSelectPriceProviderAutoDetect(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	// Override the detection seam so auto-detect resolves to the reachable test server.
-	origDetect := detectOpenCost
-	defer func() { detectOpenCost = origDetect }()
-	detectOpenCost = func(kubernetes.Interface) string { return srv.URL }
+	// Override the auto-detect seam so it resolves to the reachable test server (the real seam
+	// routes through the API server proxy, which needs a live cluster).
+	origDetect := openCostAutoProvider
+	defer func() { openCostAutoProvider = origDetect }()
+	openCostAutoProvider = func(ctx context.Context, _ *kube.Clients, window string) (pricing.Provider, string, bool) {
+		p, err := pricing.NewOpenCostProvider(ctx, srv.URL, window)
+		if err != nil {
+			return nil, "", false
+		}
+		return p, "opencost/opencost:9003 via the API server proxy", true
+	}
 
 	var warnings []string
 	p := selectPriceProvider(context.Background(), orchFakeClients(t), &scanFlags{window: "7d"}, &warnings)

internal/cli/scan.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"time"
 
 	"github.com/spf13/cobra"
 
@@ -160,11 +161,11 @@ func selectUsageProvider(clients *kube.Clients, f *scanFlags, warnings *[]string
 		return usage.NewMetricsServerProvider(clients.Metrics)
 	}
 
-	if url := usage.DetectPrometheus(clients.Kube); url != "" {
-		if p, err := usage.NewPrometheusProvider(url, f.window); err == nil {
-			*warnings = append(*warnings, fmt.Sprintf("auto-detected Prometheus at %s (Tier 1)", url))
-			return p
-		}
+	if p, note, ok := prometheusAutoProvider(clients, f.window); ok {
+		*warnings = append(*warnings, fmt.Sprintf("auto-detected Prometheus (%s) — Tier 1", note))
+		return p
+	} else if note != "" {
+		*warnings = append(*warnings, note)
 	}
 
 	// No Prometheus: prefer the kubetidy operator's recorded history (Tier 0) when it's
@@ -184,9 +185,48 @@ func selectUsageProvider(clients *kube.Clients, f *scanFlags, warnings *[]string
 	return usage.NewMetricsServerProvider(clients.Metrics)
 }
 
-// detectOpenCost is a seam over pricing.DetectOpenCost so tests can point auto-detection at a
-// reachable endpoint (the real detector returns an in-cluster URL that a unit test can't reach).
-var detectOpenCost = pricing.DetectOpenCost
+// prometheusAutoProvider auto-detects an in-cluster Prometheus and returns a Tier-1 provider
+// that reaches it through the Kubernetes API server proxy — which works from the user's machine,
+// where in-cluster Service DNS does not resolve. It validates reachability (a trivial query)
+// before committing, so an unreachable or wrong endpoint falls through to the operator /
+// metrics-server instead of silently producing empty, misleading results. The returned note is
+// the source label on success, or a fall-back reason when a service was found but unusable
+// (empty otherwise). It is a seam so tests can inject a reachable provider without a cluster.
+var prometheusAutoProvider = func(clients *kube.Clients, window string) (usage.Provider, string, bool) {
+	ep, ok := usage.DetectPrometheusEndpoint(clients.Kube)
+	if !ok {
+		return nil, "", false
+	}
+	p, err := usage.NewPrometheusProviderViaAPIProxy(clients.RESTConfig, ep, window)
+	if err != nil {
+		return nil, fmt.Sprintf("found Prometheus service %s/%s but could not build a client (%v); falling back",
+			ep.Namespace, ep.Service, err), false
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
+	defer cancel()
+	if !usage.Reachable(ctx, p) {
+		return nil, fmt.Sprintf("found Prometheus service %s/%s but it did not answer queries; falling back to operator/metrics-server",
+			ep.Namespace, ep.Service), false
+	}
+	return p, fmt.Sprintf("%s/%s:%d via the API server proxy", ep.Namespace, ep.Service, ep.Port), true
+}
+
+// openCostAutoProvider mirrors prometheusAutoProvider for cost: it auto-detects an in-cluster
+// OpenCost/Kubecost and returns a Tier-2 provider that reaches it through the API server proxy.
+// NewOpenCostProviderViaAPIProxy already queries the allocation API at construction, so a
+// non-answering endpoint yields ok=false and we fall back to derived pricing. Seam for tests.
+var openCostAutoProvider = func(ctx context.Context, clients *kube.Clients, window string) (pricing.Provider, string, bool) {
+	ep, ok := pricing.DetectOpenCostEndpoint(clients.Kube)
+	if !ok {
+		return nil, "", false
+	}
+	p, err := pricing.NewOpenCostProviderViaAPIProxy(ctx, clients.RESTConfig, ep, window)
+	if err != nil {
+		return nil, fmt.Sprintf("found OpenCost service %s/%s but it did not answer (%v); using derived node pricing",
+			ep.Namespace, ep.Service, err), false
+	}
+	return p, fmt.Sprintf("%s/%s:%d via the API server proxy", ep.Namespace, ep.Service, ep.Port), true
+}
 
 // selectPriceProvider picks the cost source, mirroring selectUsageProvider:
 //   - an explicit --opencost-url forces Tier 2 (precise allocated cost);
@@ -216,11 +256,11 @@ func selectPriceProvider(ctx context.Context, clients *kube.Clients, f *scanFlag
 		return fallback
 	}
 
-	if url := detectOpenCost(clients.Kube); url != "" {
-		if p, err := pricing.NewOpenCostProvider(ctx, url, f.window); err == nil {
-			*warnings = append(*warnings, fmt.Sprintf("auto-detected OpenCost at %s (Tier 2 cost)", url))
-			return p
-		}
+	if p, note, ok := openCostAutoProvider(ctx, clients, f.window); ok {
+		*warnings = append(*warnings, fmt.Sprintf("auto-detected OpenCost (%s) — Tier 2 cost", note))
+		return p
+	} else if note != "" {
+		*warnings = append(*warnings, note)
 	}
 	return fallback
 }

internal/kube/kube.go

@@ -13,17 +13,22 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
 )
 
 // Clients bundles the Kubernetes API clients and resolved context metadata
 // that the rest of kubetidy needs.
 type Clients struct {
-	Kube      kubernetes.Interface
-	Metrics   metricsv.Interface
-	Dynamic   dynamic.Interface
-	Context   string
-	Namespace string
+	Kube    kubernetes.Interface
+	Metrics metricsv.Interface
+	Dynamic dynamic.Interface
+	// RESTConfig is the resolved client config. It's kept so callers can reach in-cluster
+	// services (e.g. Prometheus) through the API server proxy, which works from outside the
+	// cluster where in-cluster Service DNS does not resolve.
+	RESTConfig *rest.Config
+	Context    string
+	Namespace  string
 }
 
 // Load builds API clients from the user's kubeconfig, honoring the active
@@ -85,11 +90,12 @@ func Load(contextOverride, namespaceOverride string) (*Clients, error) {
 	}
 
 	return &Clients{
-		Kube:      kubeClient,
-		Metrics:   metricsClient,
-		Dynamic:   dynamicClient,
-		Context:   contextName,
-		Namespace: namespace,
+		Kube:       kubeClient,
+		Metrics:    metricsClient,
+		Dynamic:    dynamicClient,
+		RESTConfig: restConfig,
+		Context:    contextName,
+		Namespace:  namespace,
 	}, nil
 }
 

internal/pricing/detect.go

@@ -27,13 +27,26 @@ var opencostCandidates = []ocCandidate{
 	{"kubecost", "kubecost-cost-analyzer-abc", 9090},
 }
 
-// DetectOpenCost probes the cluster for a well-known OpenCost (or Kubecost) Service and returns
-// its in-cluster API base URL (e.g. "http://opencost.opencost.svc:9003") when found, or ""
-// when none is present. Like DetectPrometheus, it only confirms the Service exists; the caller
-// (NewOpenCostProvider) validates that the API actually answers. Best-effort, never errors.
-func DetectOpenCost(client kubernetes.Interface) string {
+// OpenCostEndpoint identifies a detected in-cluster OpenCost/Kubecost Service by coordinates, so
+// the caller can reach it either directly (in-cluster) or through the API server proxy (from
+// outside the cluster).
+type OpenCostEndpoint struct {
+	Namespace string
+	Service   string
+	Port      int32
+}
+
+// InClusterURL is the direct, in-cluster API base URL (only resolvable from inside the cluster).
+func (e OpenCostEndpoint) InClusterURL() string {
+	return fmt.Sprintf("http://%s.%s.svc:%d", e.Service, e.Namespace, e.Port)
+}
+
+// DetectOpenCostEndpoint probes the cluster for a well-known OpenCost (or Kubecost) Service and
+// returns its coordinates when found. It only confirms the Service exists; the caller validates
+// that the API answers. Best-effort, never errors.
+func DetectOpenCostEndpoint(client kubernetes.Interface) (OpenCostEndpoint, bool) {
 	if client == nil {
-		return ""
+		return OpenCostEndpoint{}, false
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
@@ -47,9 +60,20 @@ func DetectOpenCost(client kubernetes.Interface) string {
 		if p := firstServicePort(svc); p != 0 {
 			port = p
 		}
-		return fmt.Sprintf("http://%s.%s.svc:%d", c.service, c.namespace, port)
+		return OpenCostEndpoint{Namespace: c.namespace, Service: c.service, Port: port}, true
+	}
+	return OpenCostEndpoint{}, false
+}
+
+// DetectOpenCost returns the in-cluster API base URL of a detected OpenCost, or "" when none is
+// present. Retained for callers/tests that want the direct URL; new code should prefer
+// DetectOpenCostEndpoint so it can route through the API server proxy.
+func DetectOpenCost(client kubernetes.Interface) string {
+	ep, ok := DetectOpenCostEndpoint(client)
+	if !ok {
+		return ""
 	}
-	return ""
+	return ep.InClusterURL()
 }
 
 // firstServicePort returns the first declared port of a Service, or 0 if none.

internal/pricing/opencost.go

@@ -10,6 +10,8 @@ import (
 	"strings"
 	"time"
 
+	"k8s.io/client-go/rest"
+
 	"github.com/kubetidy/kubetidy/internal/model"
 )
 
@@ -64,6 +66,24 @@ func NewOpenCostProvider(ctx context.Context, baseURL, window string) (Provider,
 	return newOpenCostProviderWithClient(ctx, &http.Client{Timeout: 10 * time.Second}, baseURL, window)
 }
 
+// NewOpenCostProviderViaAPIProxy builds a Tier-2 provider that reaches an in-cluster OpenCost
+// Service through the Kubernetes API server proxy — so `scan`, running on the user's machine,
+// can talk to a Service whose DNS only resolves in-cluster, with no port-forward. It reuses the
+// kubeconfig's API server address and credentials.
+func NewOpenCostProviderViaAPIProxy(ctx context.Context, cfg *rest.Config, ep OpenCostEndpoint, window string) (Provider, error) {
+	if cfg == nil {
+		return nil, fmt.Errorf("opencost: nil rest config")
+	}
+	transport, err := rest.TransportFor(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("opencost: building API server transport: %w", err)
+	}
+	base := strings.TrimRight(cfg.Host, "/") +
+		fmt.Sprintf("/api/v1/namespaces/%s/services/%s:%d/proxy", ep.Namespace, ep.Service, ep.Port)
+	httpc := &http.Client{Transport: transport, Timeout: 15 * time.Second}
+	return newOpenCostProviderWithClient(ctx, httpc, base, window)
+}
+
 // newOpenCostProviderWithClient is the testable core: it accepts the HTTP client so tests can
 // point it at an httptest.Server.
 func newOpenCostProviderWithClient(ctx context.Context, httpc *http.Client, baseURL, window string) (Provider, error) {