Beats: Add namespace labels to kubernetes metadata

[jeffspahr]

As operators of a multi tenant Kubernetes cluster and operators of the Elastic Stack we want to be able to drop logs by namespace when log rates exceed a certain number. We'd like to control this by adding labels to a namespace and including the drop logic in logstash.

Our logs flow like this:
Filebeat -> Kafka -> Logstash -> Elasticsearch

The pod's metadata is added to each log, but it would be nice to also include the namespace's metadata (namespace labels in particular).

Downsides to applying the label directly to pods:

We would be touching workloads we may not own. The application owner owns their deployments, replicasets, and pods.
Pods can be frequently redeployed which would clear out the label.
Pros to apply the label to the namespace:

It's easier to label an entire namespace instead of chasing individual noisy pods.
Kubernetes resource quotas are scoped to a namespace. It makes sense to follow the same pattern for logging quotas too.

References:
https://www.elastic.co/guide/en/beats/filebeat/master/add-kubernetes-metadata.html
https://www.elastic.co/guide/en/beats/filebeat/master/exported-fields-kubernetes-processor.html
https://discuss.elastic.co/t/filebeat-kubernetes-metadata-add-namespace-labels-to-kubernetes-metadata/201715

[exekias]

Thank you for opening @jeffspahr! I think we should do this!

This should cover:

• add_kubernetes_metadata
• kubernetes autodiscover provider
• internal events enrichment from kubernetes module

Labels must be "dedotted" as we do with Pod labels.

We currently report kubernetes.namespace as a string. That represents a problem as moving to this is a breaking change:

kubernetes.namespace.name: kube-system
kubernetes.namespace.labels.foo: bar

Perhaps doing this for now and do the breaking change in 8.0 would do:

kubernetes.namespace: kube_system
kubernetes.namespace_labels.foo: bar

cc @ChrsMark @sorantis

[exekias]

Forgot about annotations. I think they should work in the same way as for Pods. Users can decide to include them as an opt-in thing, through the include_annotations parameter.

[ChrsMark]

A first implementation for this can be found on https://github.com/elastic/beats/pull/13921.

Currently the namespaces' labels are being detoted using the LabelsDedot configuration that already exists. Would we like to introduce a different one?
Also would we like to also add the include_labels and exclude_labels functionality in this?

[jeffspahr]

Thanks for jumping on this so quickly @exekias @ChrsMark !

[exekias]

https://github.com/elastic/beats/issues/14044 should open the door for easily implement this