[CASCL-1304] Fix Fargate profile name in dd-cluster-info ConfigMap (#3000)

* [CASCL-1304] Fix Fargate profile name in dd-cluster-info ConfigMap

The dd-cluster-info ConfigMap was writing an empty string as the
Fargate profile-name bucket key, because `classifyNodeByLabel` read
`eks.amazonaws.com/fargate-profile` from the Node. EKS stamps that
label on the Pod scheduled on the Fargate node, not on the Node
itself, so the read always returned "".

Resolve the profile name by listing Pods filtered server-side with
`LabelSelector: "eks.amazonaws.com/fargate-profile"`, building a
nodeName→profileName index, and threading it through the classifier.
A Fargate node with no Pod yet scheduled keeps falling into the
empty-key bucket — acceptable for a one-shot informational snapshot.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [CASCL-1304] Cover error and empty-NodeName branches of fargateProfilesByNode

The patch coverage gate failed at 72.72% (threshold 80%) because three new
branches in classify.go were untested:
- Classify error-return when fargateProfilesByNode fails.
- The empty-NodeName skip path in fargateProfilesByNode.
- The List error wrap path in fargateProfilesByNode.

Adds two tests that close those branches via fake-clientset reactors and a
pending pod fixture, mirroring the existing API-list-error pattern in
guess/karpenter_test.go. fargateProfilesByNode now reaches 100% statement
coverage and the package totals 93.9%.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: L3n41c

cmd/kubectl-datadog/autoscaling/cluster/common/clusterinfo/classify.go

@@ -88,7 +88,12 @@ func Classify(ctx context.Context, in ClassifyInput) (*ClusterInfo, error) {
 	}
 	info.ClusterARN, info.Region = describeClusterIdentity(ctx, in.EKS, in.ClusterName)
 
-	asgCandidates, err := classifyByLabels(ctx, in.K8sClient, info)
+	fargateProfileByNode, err := fargateProfilesByNode(ctx, in.K8sClient)
+	if err != nil {
+		return nil, err
+	}
+
+	asgCandidates, err := classifyByLabels(ctx, in.K8sClient, fargateProfileByNode, info)
 	if err != nil {
 		return nil, err
 	}
@@ -115,6 +120,35 @@ func Classify(ctx context.Context, in ClassifyInput) (*ClusterInfo, error) {
 	return info, nil
 }
 
+// fargateProfilesByNode lists Pods that carry the
+// `eks.amazonaws.com/fargate-profile` label (server-side filtered) and indexes
+// the profile name by the Node the Pod is scheduled on. EKS stamps that label
+// on the Pod, not on the Node, so the Node listing alone cannot recover the
+// profile name. A Fargate node hosts exactly one user pod, so the map is
+// uncontested in practice.
+func fargateProfilesByNode(ctx context.Context, k8sClient kubernetes.Interface) (map[string]string, error) {
+	const fargateProfileLabel = "eks.amazonaws.com/fargate-profile"
+
+	out := map[string]string{}
+	p := pager.New(func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+		return k8sClient.CoreV1().Pods(corev1.NamespaceAll).List(ctx, opts)
+	})
+	opts := metav1.ListOptions{LabelSelector: fargateProfileLabel}
+	if err := p.EachListItem(ctx, opts, func(obj runtime.Object) error {
+		pod := obj.(*corev1.Pod)
+		if pod.Spec.NodeName == "" {
+			return nil
+		}
+		if profile := pod.Labels[fargateProfileLabel]; profile != "" {
+			out[pod.Spec.NodeName] = profile
+		}
+		return nil
+	}); err != nil {
+		return nil, fmt.Errorf("failed to list Fargate pods: %w", err)
+	}
+	return out, nil
+}
+
 // asgCandidate is a node that needs an AWS API call to determine whether
 // it's in an ASG (asg bucket) or not (standalone bucket).
 type asgCandidate struct {
@@ -126,15 +160,15 @@ type asgCandidate struct {
 // decision tree (Fargate, Karpenter, EKS managed node group, unknown). Nodes
 // with an AWS EC2 providerID that don't match any of the above are returned
 // as ASG candidates for resolveASGs to bucket as asg or standalone.
-func classifyByLabels(ctx context.Context, k8sClient kubernetes.Interface, info *ClusterInfo) ([]asgCandidate, error) {
+func classifyByLabels(ctx context.Context, k8sClient kubernetes.Interface, fargateProfileByNode map[string]string, info *ClusterInfo) ([]asgCandidate, error) {
 	var candidates []asgCandidate
 
 	p := pager.New(func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
 		return k8sClient.CoreV1().Nodes().List(ctx, opts)
 	})
 	if err := p.EachListItem(ctx, metav1.ListOptions{}, func(obj runtime.Object) error {
 		node := obj.(*corev1.Node)
-		if mgr, entity, ok := classifyNodeByLabel(node); ok {
+		if mgr, entity, ok := classifyNodeByLabel(node, fargateProfileByNode); ok {
 			addToBucket(info, mgr, entity, node.Name)
 			return nil
 		}
@@ -155,12 +189,13 @@ func classifyByLabels(ctx context.Context, k8sClient kubernetes.Interface, info
 	return candidates, nil
 }
 
-// classifyNodeByLabel applies steps 1-3 of the decision tree using only the
-// Node labels and name. Returns false when the node needs an AWS API lookup
-// or the unknown-bucket fallback.
-func classifyNodeByLabel(node *corev1.Node) (NodeManager, string, bool) {
+// classifyNodeByLabel applies steps 1-3 of the decision tree using the Node
+// labels, the Node name, and a pre-built nodeName→Fargate-profile index.
+// Returns false when the node needs an AWS API lookup or the unknown-bucket
+// fallback.
+func classifyNodeByLabel(node *corev1.Node, fargateProfileByNode map[string]string) (NodeManager, string, bool) {
 	if node.Labels["eks.amazonaws.com/compute-type"] == "fargate" || strings.HasPrefix(node.Name, "fargate-ip-") {
-		return NodeManagerFargate, node.Labels["eks.amazonaws.com/fargate-profile"], true
+		return NodeManagerFargate, fargateProfileByNode[node.Name], true
 	}
 
 	if v := node.Labels["karpenter.sh/nodepool"]; v != "" {

cmd/kubectl-datadog/autoscaling/cluster/common/clusterinfo/classify_test.go

@@ -97,6 +97,13 @@ func node(name string, providerID string, labels map[string]string) *corev1.Node
 	}
 }
 
+func pod(name, namespace, nodeName string, labels map[string]string) *corev1.Pod {
+	return &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace, Labels: labels},
+		Spec:       corev1.PodSpec{NodeName: nodeName},
+	}
+}
+
 func deploymentWith(namespace, name string, labels map[string]string, image string) *appsv1.Deployment {
 	return &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{Namespace: namespace, Name: name, Labels: labels},
@@ -195,12 +202,17 @@ func TestClassify_ClusterIdentity_DescribeError(t *testing.T) {
 
 func TestClassify_AllBucketsByLabel(t *testing.T) {
 	objs := []runtime.Object{
-		// fargate via label
+		// fargate via label; profile name comes from the hosted Pod's label
+		// (EKS stamps `eks.amazonaws.com/fargate-profile` on the Pod, not the
+		// Node).
 		node("fargate-by-label", "aws:///us-east-1a/fargate-abc", map[string]string{
-			"eks.amazonaws.com/compute-type":    "fargate",
+			"eks.amazonaws.com/compute-type": "fargate",
+		}),
+		pod("workload", "default", "fargate-by-label", map[string]string{
 			"eks.amazonaws.com/fargate-profile": "fp-default",
 		}),
-		// fargate via name fallback (no compute-type label)
+		// fargate via name fallback (no compute-type label, no Pod yet
+		// scheduled) — exercises the empty-key fallback path.
 		node("fargate-ip-10-0-0-1.eu-west-3.compute.internal", "", nil),
 		// karpenter via primary label
 		node("kp-primary", "aws:///us-east-1a/i-0aaa", map[string]string{
@@ -248,6 +260,64 @@ func TestClassify_AllBucketsByLabel(t *testing.T) {
 	assert.Empty(t, asg.calls, "label-only nodes must not trigger AWS calls")
 }
 
+func TestClassify_FargateMultipleProfiles(t *testing.T) {
+	clientset := fake.NewSimpleClientset(
+		node("fargate-a", "", map[string]string{"eks.amazonaws.com/compute-type": "fargate"}),
+		node("fargate-b", "", map[string]string{"eks.amazonaws.com/compute-type": "fargate"}),
+		pod("workload-a", "team-a", "fargate-a", map[string]string{
+			"eks.amazonaws.com/fargate-profile": "fp-team-a",
+		}),
+		pod("workload-b", "team-b", "fargate-b", map[string]string{
+			"eks.amazonaws.com/fargate-profile": "fp-team-b",
+		}),
+	)
+
+	info, err := Classify(t.Context(), classifyOpts(clientset, &fakeASG{}))
+	require.NoError(t, err)
+
+	assert.Equal(t, []string{"fargate-a"},
+		info.NodeManagement[NodeManagerFargate]["fp-team-a"].Nodes)
+	assert.Equal(t, []string{"fargate-b"},
+		info.NodeManagement[NodeManagerFargate]["fp-team-b"].Nodes)
+}
+
+// TestClassify_FargatePendingPodSkipped guards the empty-NodeName branch of
+// fargateProfilesByNode: a Pod that carries the Fargate label but isn't yet
+// scheduled onto a Node must not populate the index (and must not panic).
+func TestClassify_FargatePendingPodSkipped(t *testing.T) {
+	clientset := fake.NewSimpleClientset(
+		node("fargate-a", "", map[string]string{"eks.amazonaws.com/compute-type": "fargate"}),
+		// Scheduled pod -> profile resolves normally.
+		pod("workload-a", "team-a", "fargate-a", map[string]string{
+			"eks.amazonaws.com/fargate-profile": "fp-team-a",
+		}),
+		// Pending pod (no NodeName yet) -> must be ignored.
+		pod("workload-pending", "team-a", "", map[string]string{
+			"eks.amazonaws.com/fargate-profile": "fp-team-a",
+		}),
+	)
+
+	info, err := Classify(t.Context(), classifyOpts(clientset, &fakeASG{}))
+	require.NoError(t, err)
+
+	assert.Equal(t, []string{"fargate-a"},
+		info.NodeManagement[NodeManagerFargate]["fp-team-a"].Nodes)
+}
+
+// TestClassify_FargatePodListErrorPropagates guards the error path of
+// fargateProfilesByNode: a failing Pod listing must surface to the caller
+// of Classify wrapped with a recognisable message.
+func TestClassify_FargatePodListErrorPropagates(t *testing.T) {
+	clientset := fake.NewSimpleClientset()
+	clientset.PrependReactor("list", "pods", func(_ k8stesting.Action) (bool, runtime.Object, error) {
+		return true, nil, apierrors.NewServiceUnavailable("test failure")
+	})
+
+	_, err := Classify(t.Context(), classifyOpts(clientset, &fakeASG{}))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to list Fargate pods")
+}
+
 func TestClassify_ASGAndStandalone(t *testing.T) {
 	clientset := fake.NewSimpleClientset(
 		node("worker-1", "aws:///us-east-1a/i-1111", nil),
@@ -448,11 +518,15 @@ func TestClassify_KarpenterNodePoolOwnership_NoCRD(t *testing.T) {
 func TestClassify_FargateProfileOwnership(t *testing.T) {
 	clientset := fake.NewSimpleClientset(
 		node("fargate-1", "", map[string]string{
-			"eks.amazonaws.com/compute-type":    "fargate",
-			"eks.amazonaws.com/fargate-profile": "dd-karpenter-test",
+			"eks.amazonaws.com/compute-type": "fargate",
 		}),
 		node("fargate-2", "", map[string]string{
-			"eks.amazonaws.com/compute-type":    "fargate",
+			"eks.amazonaws.com/compute-type": "fargate",
+		}),
+		pod("workload-1", "default", "fargate-1", map[string]string{
+			"eks.amazonaws.com/fargate-profile": "dd-karpenter-test",
+		}),
+		pod("workload-2", "default", "fargate-2", map[string]string{
 			"eks.amazonaws.com/fargate-profile": "third-party",
 		}),
 	)
@@ -476,7 +550,9 @@ func TestClassify_FargateProfileOwnership_DescribeError(t *testing.T) {
 	// stays unflagged and a warning is logged.
 	clientset := fake.NewSimpleClientset(
 		node("fargate-1", "", map[string]string{
-			"eks.amazonaws.com/compute-type":    "fargate",
+			"eks.amazonaws.com/compute-type": "fargate",
+		}),
+		pod("workload-1", "default", "fargate-1", map[string]string{
 			"eks.amazonaws.com/fargate-profile": "dd-karpenter-test",
 		}),
 	)