dx/shadow_profiles: stop OOM-killing ClickHouse — read the pinned view

[ConstanzeTU]

dx/shadow_profiles.learned reads kubescape_profiles directly and does groupby(namespace, name).agg(px.any) over execs, opens, egress, ingress, syscalls and capabilities. Those columns hold a container's entire learned behaviour as newline-joined text, so the query materialises every generation of every profile to compute an arbitrary "any" of the newest.

Measured on edge4

distinct profiles	234
generations	624,447 (~2,669 each)
table size	501 MB
cost per run	~1.95 GiB

The panel auto-refreshes every 10–40s, so concurrent refreshes crossed the ClickHouse server's 5.40 GiB total budget and the container was OOMKilled (exit 137) on 2026-09-10 at 09:39:19Z. One open browser tab is sufficient — no attacker, no unusual state.

It also cost the KPI series a tick: the single gap in edge4's 220 measured ticks is that outage. A dashboard put a hole in the measurement that evidences completeness.

The change

Read forensic_db.dx_profiles__latest instead — one row per (namespace, name), newest generation, resolved over event_time alone so no wide column is read before the row set is pinned. Measured on edge4 before writing it: 82.35 MiB and 105 ms, about 24× cheaper.

The view ships in adaptive-export 0.16.6-rc1 (#105) and is created at boot. That must be deployed first — the view is inert until something selects from it, so it can land ahead of this safely, but this cannot land ahead of it.

Why the ratio was checked first

If generations had been roughly 1:1 with profiles, the fat columns were never the multiplier and the diagnosis would have been wrong. 2,669:1 is what makes the pin the fix.

Related

Adaptive-export 0.16.4-rc1 replaced soc's ks-ch-sync CronJob, which produced those 2,669 generations by re-writing every profile every two minutes regardless of change (k8sstormcenter/soc#274). That shrinks the input from here on; this PR makes reading the history already stored safe.

signatures.ledger and profile_coverage.governed read the same table and escape only because they touch thin columns — a property of their current projection, not a guarantee. The rule for this table: never select a fat column without first pinning to one row per (namespace, name).

🤖 Generated with Claude Code

https://claude.ai/code/session_014GDT6HWiFmRxmUaGFSKjPY