chore(deps): Update cAdvisor to v0.60.5

[dehaansa]

Brief description of Pull Request

Updates the cAdvisor dependency from v0.54.1 to v0.60.5 (Grafana grafana-v0.60.5-noglobals fork).

Pull Request Details

cAdvisor v0.60 moved most of its library packages into a new github.com/google/cadvisor/lib submodule. The root module points /lib at a local ./lib replace, which Go ignores when the module is consumed as a dependency. To make it resolve, collector/builder-config.yaml now carries a second require/replace pair that redirects github.com/google/cadvisor/lib to the same Grafana fork commit, and the go.mod files are regenerated with make generate-otel-collector-distro.

The integration imports are rewritten to the new /lib paths. container/docker and info/v2 stayed in the root module, so those imports are unchanged. No cAdvisor API signatures changed.

Stacked on top of #7039 (the cAdvisor integration test); this PR targets that branch so its diff is only the dependency update.

Issue(s) fixed by this Pull Request

Notes to the Reviewer

PR Checklist

• Documentation added
• Tests updated
• Config converters updated
• This pull request was substantially generated with AI assistance (see the GenAI policy)

[github-actions]

🔍 Dependency Review

Below are the dependency changes detected in go.mod files, with required code updates (if any), supporting evidence, and minimal example diffs to adopt the upgrades.

---

github.com/google/cadvisor v0.54.1 -> v0.60.5 — ❌ Changes Needed

Summary of required changes:

• cAdvisor v0.60 split most of its library code under github.com/google/cadvisor/lib/... and removed most process-global singletons/registries. Import paths and initialization must be updated.
• The manager.New API changed to require filesystem plugins to be passed per-instance (and not via a global registry).
• Optional collectors (perf events, resctrl/Intel RDT, and application metrics) are now injected via instance factories rather than enabled globally. Wire them explicitly to preserve existing behavior.
• Some metric families were added (PSI, cgroup v2 memory events/pages, CPU CFS burst accounting, container_start_time_seconds). Tests that validate an allowlist/expect-list should be updated.

Minimal code changes (already reflected in this PR):

1. Update imports from old top-level packages to the split lib module:

- "github.com/google/cadvisor/cache/memory"
- "github.com/google/cadvisor/container"
- "github.com/google/cadvisor/manager"
- "github.com/google/cadvisor/metrics"
- "github.com/google/cadvisor/storage"
- "github.com/google/cadvisor/utils/sysfs"
+ "github.com/google/cadvisor/lib/cache/memory"
+ "github.com/google/cadvisor/lib/container"
+ "github.com/google/cadvisor/lib/fs"
+ "github.com/google/cadvisor/lib/manager"
+ "github.com/google/cadvisor/lib/metrics"
+ "github.com/google/cadvisor/lib/stats"
+ "github.com/google/cadvisor/lib/storage"
+ "github.com/google/cadvisor/lib/utils/sysfs"

2. Update container plugin imports to their new locations under lib (docker remains outside lib):

- "github.com/google/cadvisor/container/containerd"
- "github.com/google/cadvisor/container/crio"
- "github.com/google/cadvisor/container/raw"
- "github.com/google/cadvisor/container/systemd"
+ "github.com/google/cadvisor/lib/container/containerd"
+ "github.com/google/cadvisor/lib/container/crio"
+ "github.com/google/cadvisor/lib/container/raw"
+ "github.com/google/cadvisor/lib/container/systemd"

 // still:
  "github.com/google/cadvisor/container/docker"

3. Pass filesystem plugins to manager.New (replaces former global registration); build the fsPlugins map:

+ // Filesystem plugins now selected per instance.
+ fsPlugins := map[string]fs.FsPlugin{
+   "btrfs":        btrfs.NewPlugin(),
+   "devicemapper": devicemapper.NewPlugin(),
+   "nfs":          nfs.NewPlugin(),
+   "overlay":      overlay.NewPlugin(),
+   "tmpfs":        tmpfs.NewPlugin(),
+   "vfs":          vfs.NewPlugin(),
+   "zfs":          zfs.NewPlugin(),
+ }

4. Inject optional collectors (perf, resctrl, application metrics) to preserve behavior previously provided by globals:

+ manager.PerfManagerFactory = perf.NewManager
+ manager.ResctrlManagerFactory = func(interval time.Duration, vendorID string, inHostNamespace bool) (stats.ResctrlManager, error) {
+   return intel.NewManager(interval, intel.Setup, vendorID, inHostNamespace, c.DockerOnly)
+ }
+ manager.CollectorManagerFactory = func(handler container.ContainerHandler, readFile func(string) ([]byte, error), httpClient *http.Client) (manager.CollectorManager, error) {
+   return appmetrics.NewManager(handler, readFile, httpClient, manager.ApplicationMetricsCountLimit())
+ }

5. Update the manager.New call to include fsPlugins (new parameter) and use the lib types:

- rm, err := manager.New(plugins, memoryStorage, sysFs, manager.HousekeepingConfigFlags, includedMetrics, &collectorHTTPClient, c.RawCgroupPrefixAllowlist, c.EnvMetadataAllowlist, c.PerfEventsConfig, time.Duration(c.ResctrlInterval), rawOpts)
+ rm, err := manager.New(plugins, fsPlugins, memoryStorage, sysFs, manager.HousekeepingConfigFlags, includedMetrics, &collectorHTTPClient, c.RawCgroupPrefixAllowlist, c.EnvMetadataAllowlist, c.PerfEventsConfig, time.Duration(c.ResctrlInterval), rawOpts)

6. Update tests to include metrics introduced since v0.54 (PSI, CFS burst, cgroup v2 memory events/pages, container start time):

- // Two families are left out on purpose:
- //   - container_pressure_* (PSI) needs kernel CONFIG_PSI. Not every host has it.
- //   - container_health_state needs a container with a Docker HEALTHCHECK. It
- //     depends on the sibling workloads, not the exporter.
+ // container_health_state is left out on purpose: it needs a container with a
+ // Docker HEALTHCHECK, which kind's containerd runtime does not provide.

+ // Pressure stall (PSI) metrics...
+ "container_pressure_cpu_stalled_seconds_total",
+ "container_pressure_cpu_waiting_seconds_total",
+ "container_pressure_io_stalled_seconds_total",
+ "container_pressure_io_waiting_seconds_total",
+ "container_pressure_memory_stalled_seconds_total",
+ "container_pressure_memory_waiting_seconds_total",

+ // Metrics added across the 0.58–0.60 line (cgroup v2 memory events/pages, CPU
+ // burst accounting, and container start time).
+ "container_cpu_cfs_burst_periods_total",
+ "container_cpu_cfs_burst_seconds_total",
+ "container_memory_events_high_total",
+ "container_memory_events_max_total",
+ "container_memory_pgscan_total",
+ "container_memory_pgsteal_total",
+ "container_memory_workingset_refault_anon_total",
+ "container_memory_workingset_refault_file_total",
+ "container_start_time_seconds",

Notes about the new submodule:

• cAdvisor v0.60 split the library into a separate module path github.com/google/cadvisor/lib; you must add it as a requirement (this PR does), and, when using a fork, add a replace for github.com/google/cadvisor/lib as well (also done in this PR).

Evidence:

• cAdvisor v0.60.0 release notes: library split under /lib, removal of process-global registries/singletons, new manager.New signature that receives fs plugins, and injection points for perf/resctrl/appmetrics.
  • https://github.com/google/cadvisor/releases/tag/v0.60.0
• Feature additions across v0.58–v0.60 include PSI export improvements and new cgroup v2 metrics (CPU CFS burst, memory events/pages) and container_start_time_seconds.
  • https://github.com/google/cadvisor/releases/tag/v0.58.0
  • https://github.com/google/cadvisor/releases/tag/v0.59.0
  • https://github.com/google/cadvisor/releases/tag/v0.60.0

---

github.com/containerd/containerd/api v1.9.0 -> v1.10.0 — ✅ Safe

• This module provides generated API/protobuf types for containerd. Changes in 1.10.0 are additive and compatible for consumers using it transitively through other projects.
• No code changes required in this repository.

Evidence:

• Containerd 1.10 API proto bumps are backward compatible for Go consumers; no direct usage in this repository's code.
  • https://github.com/containerd/containerd/releases

---

github.com/containerd/ttrpc v1.2.7 -> v1.2.9 — ✅ Safe

• Minor updates with bug fixes and internal improvements.
• No direct usage here; upgrade is transitive. No code changes required.

Evidence:

• ttrpc v1.2.x changes are backward compatible for consumers.
  • https://github.com/containerd/ttrpc/releases

---

github.com/opencontainers/cgroups v0.0.4 -> v0.0.6 — ✅ Safe

• Patch/minor updates in the legacy cgroups module used transitively (e.g., by runc/cadvisor).
• No API usage in this repository; no code changes needed.

Evidence:

• No breaking API noted between 0.0.4 and 0.0.6.
  • https://github.com/opencontainers/runc/tree/main/libcontainer/cgroups

---

github.com/opencontainers/selinux v1.13.0 -> v1.13.1 — ✅ Safe

• Patch release with fixes. Used transitively by container runtimes.
• No direct imports in this repo; no code changes required.

Evidence:

• Patch bump only; no API changes required for consumers.
  • https://github.com/opencontainers/selinux/releases

---

github.com/opencontainers/runc (replace) v1.2.8 -> v1.3.6 — ⚠️ Needs Review

What changed:

• The repository pins runc to v1.3.6 (was v1.2.8) via replace to keep libcontainer subpackages (e.g., libcontainer/{cgroups,intelrdt,user}) that cAdvisor and other deps still import.
• runc v1.4.0+ removed some of these subpackages; staying on v1.3.x is intentional to avoid breaking downstream dependencies.

Code impact:

• No code changes are required here for v1.2.8 -> v1.3.6. This pin ensures transitive imports used by cAdvisor continue to resolve.
• Note: The root go.mod shows a require on runc v1.4.3, but the replace forces v1.3.6; the replace takes precedence and is sufficient.

Evidence:

• runc release notes indicate removal/relocation of some libcontainer packages in v1.4.0+, which would break consumers expecting them.
  • https://github.com/opencontainers/runc/releases/tag/v1.4.0
  • https://github.com/opencontainers/runc/releases/tag/v1.3.6

---

Notes

• New module: github.com/google/cadvisor/lib (added due to cAdvisor v0.60 library split). This is expected and required to build against v0.60+; the PR already adds a replace to the Grafana fork for both github.com/google/cadvisor and github.com/google/cadvisor/lib.
• Removed indirects (e.g., github.com/docker/docker, github.com/euank/go-kmsg-parser, github.com/karrick/godirwalk, github.com/moby/sys/atomicwriter, github.com/morikuni/aec) appear to be fallout from the cAdvisor refactor and general dep pruning. No direct imports in this repo were using them, so no action is needed.

[Copilot]

🟡 Changes recommended

Address the factory-global race, portability issues in Kubernetes metric assertions, and stale vulnerability-ignore rationale.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates cAdvisor from v0.54.1 to v0.60.5 and adapts the integration to its split /lib module layout.

Changes:

• Rewrites cAdvisor imports and integration wiring.
• Updates dependency replacements, versions, and checksums.
• Expands Kubernetes integration metric assertions.

File summaries

File	Reviewed changes and findings
internal/static/integrations/cadvisor/cadvisor.go	Critical (1 vote): Package-level factory globals can race during reloads or multiple exporters and overwrite instance-specific state.
integration-tests/k8s/tests/prometheus-exporter-cadvisor/k8s_test.go	Moderate (3 votes): PSI metrics need capability gating. Moderate (1 vote): cgroup-v2 metrics need feature-aware assertions. Moderate (2 votes): Burst metrics require a CPU-limited fixture.
go.sum	Refreshes dependency checksums.
go.mod	Updates dependencies. Moderate (1 vote): Stale Docker vulnerability ignores should be updated or removed.
collector/go.sum	Refreshes collector dependency checksums.
collector/go.mod	Regenerates collector dependencies.
collector/builder-config.yaml	Adds cAdvisor fork module replacements.

Review details

Suppressed comments (2)

go.mod:60

• This bump removes the legacy github.com/docker/docker requirement, but .govulncheck.yaml still has five ignores whose reasons say cAdvisor is the remaining importer and that they should be revisited when cAdvisor drops that dependency. Please update or remove those entries with this change; otherwise the vulnerability ignore policy remains stale and can suppress findings under an obsolete rationale.

	github.com/google/cadvisor v0.60.5

integration-tests/k8s/tests/prometheus-exporter-cadvisor/k8s_test.go:96

• These cgroup-v2-dependent memory metrics are not guaranteed by the test setup: the manifest only mounts the host cgroup filesystem and does not require a cgroup-v2 node. On a cgroup-v1 kind/local node cAdvisor legitimately omits these series, so QueryMetrics will time out; assert only feature-independent metrics or enforce/skip based on the cgroup version.

		"container_memory_events_high_total",
		"container_memory_events_max_total",
		"container_memory_pgscan_total",
		"container_memory_pgsteal_total",
		"container_memory_workingset_refault_anon_total",

• Files reviewed: 5/7 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[thampiotr]

@dehaansa I think there are some govulncheck exceptions waiting for this upgrade. Do you want to add them to this PR or later?

[dehaansa]

@dehaansa I think there are some govulncheck exceptions waiting for this upgrade. Do you want to add them to this PR or later?

I briefly looked into it and I think they still end up transitive dependencies of the mongodb exporter :(. Planning to investigate further in a follow up.

The base branch was changed.