app/vlagent: pre-fetch all namespaces at startup to avoid blocking log reading

This change improves performance and security by fetching all namespace
metadata once at application startup instead of making on-demand network
calls during log processing.

Key changes:

- Add getAllNamespaces() method to fetch all namespaces in a single API call
- Pre-fetch and cache all namespace metadata in startKubernetesCollector()
- Remove getNamespace() on-demand fetching to eliminate runtime network calls
- Change getNamespace() to cache-only lookup returning (namespace, bool)
- Skip pods from namespaces not in cache to prevent processing logs with
  incomplete metadata that could bypass excludeFilter

Benefits:

- Eliminates network call latency during log reading (no blocking)
- Prevents vlagent from appearing hung during network issues
- Ensures excludeFilter has complete namespace labels/annotations for
  security-sensitive filtering (e.g., audit logs)
- Simplifies code by removing timeout/retry logic
- Fail-fast: vlagent exits if unable to fetch namespaces at startup

Note: If a namespace is created after vlagent starts, pods in that namespace
will be skipped until vlagent is restarted. This is acceptable as it ensures
we never process logs without complete metadata.

Updates VictoriaMetrics#949

Author: withlin

app/vlagent/kubernetescollector/client.go

@@ -293,6 +293,37 @@ type namespace struct {
 	Metadata namespaceMetadata `json:"metadata"`
 }
 
+type namespaceList struct {
+	Items []namespace `json:"items"`
+}
+
+// getAllNamespaces returns all namespaces in the Kubernetes cluster.
+//
+// See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#list-namespace-v1-core
+func (c *kubeAPIClient) getAllNamespaces(ctx context.Context) ([]namespace, error) {
+	req := c.mustCreateRequest(ctx, http.MethodGet, "/api/v1/namespaces", nil)
+	resp, err := c.c.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("cannot do %q GET request: %w", req.URL.String(), err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		payload, err := io.ReadAll(resp.Body)
+		if err != nil {
+			payload = []byte(err.Error())
+		}
+		return nil, fmt.Errorf("unexpected status code %d from %q; response: %q", resp.StatusCode, req.URL.String(), payload)
+	}
+
+	var nsl namespaceList
+	if err := json.NewDecoder(resp.Body).Decode(&nsl); err != nil {
+		return nil, fmt.Errorf("cannot decode response body: %w", err)
+	}
+
+	return nsl.Items, nil
+}
+
 // getNodes returns the list of node names in the Kubernetes cluster.
 //
 // See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#list-node-v1-core
@@ -351,33 +382,6 @@ func (c *kubeAPIClient) getNodeByName(ctx context.Context, nodeName string) (nod
 	return n, nil
 }
 
-// getNamespace returns the namespace with the given name.
-//
-// See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#read-namespace-v1-core
-func (c *kubeAPIClient) getNamespace(ctx context.Context, namespaceName string) (namespace, error) {
-	req := c.mustCreateRequest(ctx, http.MethodGet, "/api/v1/namespaces/"+namespaceName, nil)
-	resp, err := c.c.Do(req)
-	if err != nil {
-		return namespace{}, fmt.Errorf("cannot do %q GET request: %w", req.URL.String(), err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		payload, err := io.ReadAll(resp.Body)
-		if err != nil {
-			payload = []byte(err.Error())
-		}
-		return namespace{}, fmt.Errorf("unexpected status code %d from %q; response: %q", resp.StatusCode, req.URL.String(), payload)
-	}
-
-	var ns namespace
-	if err := json.NewDecoder(resp.Body).Decode(&ns); err != nil {
-		return namespace{}, fmt.Errorf("cannot decode response body: %w", err)
-	}
-
-	return ns, nil
-}
-
 func (c *kubeAPIClient) mustCreateRequest(ctx context.Context, method, urlPath string, args url.Values) *http.Request {
 	req, err := http.NewRequestWithContext(ctx, method, "/", nil)
 	if err != nil {

app/vlagent/kubernetescollector/collector.go

@@ -66,6 +66,15 @@ func startKubernetesCollector(client *kubeAPIClient, currentNodeName, logsPath,
 		namespaces:  make(map[string]namespace),
 	}
 
+	namespaces, err := client.getAllNamespaces(ctx)
+	if err != nil {
+		cancel()
+		return nil, fmt.Errorf("cannot fetch namespaces: %w; this is required for proper filtering", err)
+	}
+	for _, ns := range namespaces {
+		kc.namespaces[ns.Metadata.Name] = ns
+	}
+
 	storage := &remotewrite.Storage{}
 	newProcessor := func(commonFields []logstorage.Field) processor {
 		return newLogFileProcessor(storage, commonFields)
@@ -176,8 +185,12 @@ func (kc *kubernetesCollector) startWatchCluster(ctx context.Context, resourceVe
 }
 
 func (kc *kubernetesCollector) startReadPodLogs(pod pod) {
+	ns, ok := kc.getNamespace(pod.Metadata.Namespace)
+	if !ok {
+		return
+	}
+
 	startRead := func(pc podContainer, cs containerStatus) {
-		ns := kc.getNamespace(pod.Metadata.Namespace)
 		commonFields := getCommonFields(kc.currentNode, ns, pod, cs)
 
 		filePath := kc.getLogFilePath(pod, pc, cs)
@@ -273,27 +286,15 @@ func (kc *kubernetesCollector) stop() {
 	kc.fileCollector.stop()
 }
 
-func (kc *kubernetesCollector) getNamespace(namespaceName string) namespace {
+// getNamespace returns namespace metadata from cache.
+// Returns (namespace, false) if the namespace is not in cache.
+// For security reasons, we must not process logs without complete namespace metadata,
+// as excludeFilter may rely on namespace labels/annotations to filter sensitive logs.
+// We only use the pre-fetched namespace list from startup and do not make additional
+// network calls at runtime to avoid blocking log reading.
+func (kc *kubernetesCollector) getNamespace(namespaceName string) (namespace, bool) {
 	kc.namespacesLock.Lock()
 	ns, ok := kc.namespaces[namespaceName]
 	kc.namespacesLock.Unlock()
-	if ok {
-		return ns
-	}
-
-	ns, err := kc.client.getNamespace(kc.ctx, namespaceName)
-	if err != nil {
-		logger.Errorf("cannot get namespace %q metadata: %s", namespaceName, err)
-		return namespace{
-			Metadata: namespaceMetadata{
-				Name: namespaceName,
-			},
-		}
-	}
-
-	kc.namespacesLock.Lock()
-	kc.namespaces[namespaceName] = ns
-	kc.namespacesLock.Unlock()
-
-	return ns
+	return ns, ok
 }