Allow configuring kubernetes enrichment to not load namespaces

[imbstack]

We have a cluster with a large number of namespaces. This results in Vector's listwatching of these resources putting a heavy load on the apiserver. I would like to add a flag to the kubernetes_logs source to not load namespaces. This would mean we could not use the namespace labels in further filters and such but otherwise I don't see an obvious issue. The pod/node requests are much lighter weight due to the number of nodes being small and the pods being able to filter per-node.

Does this make sense to add? Any other drawbacks to this approach I am not seeing? Would you like this patch upstreamed if we do end up making it?

Thanks for any help!

[pront]

Hi @imbstack,

Disabling namespace list/watching in Vector’s kubernetes_logs source in exchange for lower Kubernetes API server overhead sounds like a reasonable opt-in setting.

Also, sharing two existing settings that might be useful here:

• https://vector.dev/docs/reference/configuration/sources/kubernetes_logs/#pod-exclusion
• https://vector.dev/docs/reference/configuration/sources/kubernetes_logs/#extra_namespace_label_selector

[imbstack]

Thank you! I think we already are using those two settings. We're working on testing a patch for this now and will upstream it in the coming weeks if it works for us.

[imbstack]

Just to close the loop for anyone reading this I have attempted to implement this in #23601