@oneuptime/common 10.5.32 → 10.5.34

package/Server/Utils/Monitor/MonitorMaintenanceSuppression.ts

@@ -0,0 +1,229 @@
+import ScheduledMaintenance from "../../../Models/DatabaseModels/ScheduledMaintenance";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import ObjectID from "../../../Types/ObjectID";
+import { PerSeriesCriteriaMatch } from "../../../Types/Probe/ProbeApiIngestResponse";
+import ScheduledMaintenanceService from "../../Services/ScheduledMaintenanceService";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+import SeriesResourceLabels, {
+  SeriesResourceRefs,
+} from "./SeriesResourceLabels";
+
+/*
+ * Ids and names of one resource type that are currently inside an
+ * ongoing maintenance window. Ids are OneUptime database ids; names are
+ * the resource's identifier column (hostIdentifier / clusterIdentifier /
+ * service name). A series matches if it references the resource by
+ * either form.
+ */
+export interface ResourceKeySet {
+  ids: Set<string>;
+  names: Set<string>;
+}
+
+export interface MaintainedResourceKeys {
+  hosts: ResourceKeySet;
+  dockerHosts: ResourceKeySet;
+  kubernetesClusters: ResourceKeySet;
+  services: ResourceKeySet;
+}
+
+/*
+ * Per-series counterpart to the whole-monitor
+ * `disableActiveMonitoringBecauseOfScheduledMaintenanceEvent` flag.
+ *
+ * A grouped metric monitor (group-by `host.name`, say) evaluates its
+ * criteria once per series and creates one incident/alert per breaching
+ * series. The whole-monitor flag is all-or-nothing: it only fires when
+ * the *monitor itself* is attached to a maintenance event, and it would
+ * silence every series. That leaves a gap — attaching only some of the
+ * underlying resources (10 of 100 hosts) to a maintenance window did
+ * nothing, because nothing maps an attached host back to the series it
+ * owns.
+ *
+ * This util closes that gap: it returns the fingerprints of the series
+ * whose resource is under an ongoing maintenance window, so the
+ * incident/alert creation loops can skip exactly those series while the
+ * other 90 hosts keep alerting. It covers every resource type a
+ * maintenance event can attach to AND a series can identify: Host,
+ * DockerHost, KubernetesCluster, and Service.
+ */
+export default class MonitorMaintenanceSuppression {
+  /*
+   * Resolve the per-series suppression set for one project. Returns an
+   * empty set on the common paths — no per-series matches, or no
+   * ongoing maintenance touching any resource — so callers pay at most
+   * one query and nothing when there is no maintenance.
+   */
+  @CaptureSpan()
+  public static async getSuppressedSeriesFingerprints(input: {
+    projectId: ObjectID;
+    matchesPerSeries?: Array<PerSeriesCriteriaMatch> | undefined;
+  }): Promise<Set<string>> {
+    if (!input.matchesPerSeries || input.matchesPerSeries.length === 0) {
+      return new Set<string>();
+    }
+
+    const maintained: MaintainedResourceKeys =
+      await this.getResourcesUnderOngoingMaintenance(input.projectId);
+
+    if (!this.hasAnyMaintainedResource(maintained)) {
+      return new Set<string>();
+    }
+
+    return this.getSuppressedFingerprintsForMaintainedResources({
+      matchesPerSeries: input.matchesPerSeries,
+      maintained,
+    });
+  }
+
+  /*
+   * Pure matching step, split out from the query so it can be unit
+   * tested without a database. For each series, pull the resource
+   * identifiers out of its labels and suppress the series if any of
+   * them is under maintenance.
+   */
+  public static getSuppressedFingerprintsForMaintainedResources(input: {
+    matchesPerSeries: Array<PerSeriesCriteriaMatch>;
+    maintained: MaintainedResourceKeys;
+  }): Set<string> {
+    const suppressed: Set<string> = new Set<string>();
+
+    for (const series of input.matchesPerSeries) {
+      if (!series.fingerprint || !series.labels) {
+        continue;
+      }
+
+      const refs: SeriesResourceRefs = SeriesResourceLabels.extractResourceRefs(
+        series.labels,
+      );
+
+      const isUnderMaintenance: boolean =
+        this.intersects(refs.hostIds, input.maintained.hosts.ids) ||
+        this.intersects(refs.hostNames, input.maintained.hosts.names) ||
+        this.intersects(refs.dockerHostIds, input.maintained.dockerHosts.ids) ||
+        this.intersects(
+          refs.dockerHostNames,
+          input.maintained.dockerHosts.names,
+        ) ||
+        this.intersects(
+          refs.kubernetesClusterIds,
+          input.maintained.kubernetesClusters.ids,
+        ) ||
+        this.intersects(
+          refs.kubernetesClusterNames,
+          input.maintained.kubernetesClusters.names,
+        ) ||
+        this.intersects(refs.serviceIds, input.maintained.services.ids) ||
+        this.intersects(refs.serviceNames, input.maintained.services.names);
+
+      if (isUnderMaintenance) {
+        suppressed.add(series.fingerprint);
+      }
+    }
+
+    return suppressed;
+  }
+
+  private static intersects(values: Array<string>, set: Set<string>): boolean {
+    for (const value of values) {
+      if (set.has(value)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  private static hasAnyMaintainedResource(
+    maintained: MaintainedResourceKeys,
+  ): boolean {
+    return (
+      maintained.hosts.ids.size > 0 ||
+      maintained.hosts.names.size > 0 ||
+      maintained.dockerHosts.ids.size > 0 ||
+      maintained.dockerHosts.names.size > 0 ||
+      maintained.kubernetesClusters.ids.size > 0 ||
+      maintained.kubernetesClusters.names.size > 0 ||
+      maintained.services.ids.size > 0 ||
+      maintained.services.names.size > 0
+    );
+  }
+
+  /*
+   * Collect the ids + identifiers of every Host / DockerHost /
+   * KubernetesCluster / Service attached to an ongoing maintenance event
+   * in this project. Monitors attached to the event are intentionally
+   * not collected here — those are already handled upstream by the
+   * whole-monitor disable flag, which short-circuits evaluation before
+   * we ever reach per-series creation.
+   */
+  private static async getResourcesUnderOngoingMaintenance(
+    projectId: ObjectID,
+  ): Promise<MaintainedResourceKeys> {
+    const maintained: MaintainedResourceKeys = {
+      hosts: { ids: new Set<string>(), names: new Set<string>() },
+      dockerHosts: { ids: new Set<string>(), names: new Set<string>() },
+      kubernetesClusters: { ids: new Set<string>(), names: new Set<string>() },
+      services: { ids: new Set<string>(), names: new Set<string>() },
+    };
+
+    const ongoingEvents: Array<ScheduledMaintenance> =
+      await ScheduledMaintenanceService.findBy({
+        query: {
+          projectId: projectId,
+          currentScheduledMaintenanceState: {
+            isOngoingState: true,
+          },
+        },
+        select: {
+          _id: true,
+          hosts: { _id: true, hostIdentifier: true },
+          dockerHosts: { _id: true, hostIdentifier: true },
+          kubernetesClusters: { _id: true, clusterIdentifier: true },
+          services: { _id: true, name: true },
+        },
+        skip: 0,
+        limit: LIMIT_PER_PROJECT,
+        props: {
+          isRoot: true,
+        },
+      });
+
+    for (const event of ongoingEvents) {
+      for (const host of event.hosts || []) {
+        this.addKey(maintained.hosts, host._id, host.hostIdentifier);
+      }
+      for (const dockerHost of event.dockerHosts || []) {
+        this.addKey(
+          maintained.dockerHosts,
+          dockerHost._id,
+          dockerHost.hostIdentifier,
+        );
+      }
+      for (const cluster of event.kubernetesClusters || []) {
+        this.addKey(
+          maintained.kubernetesClusters,
+          cluster._id,
+          cluster.clusterIdentifier,
+        );
+      }
+      for (const service of event.services || []) {
+        this.addKey(maintained.services, service._id, service.name);
+      }
+    }
+
+    return maintained;
+  }
+
+  private static addKey(
+    keySet: ResourceKeySet,
+    id: string | undefined,
+    name: string | undefined,
+  ): void {
+    if (id) {
+      keySet.ids.add(String(id));
+    }
+    if (name) {
+      keySet.names.add(name);
+    }
+  }
+}

package/Server/Utils/Monitor/MonitorResource.ts

@@ -35,6 +35,7 @@ import ExceptionMonitorResponse from "../../../Types/Monitor/ExceptionMonitor/Ex
 import { TelemetryQuery } from "../../../Types/Telemetry/TelemetryQuery";
 import MonitorIncident from "./MonitorIncident";
 import MonitorAlert from "./MonitorAlert";
+import MonitorMaintenanceSuppression from "./MonitorMaintenanceSuppression";
 import MonitorStatusTimelineUtil from "./MonitorStatusTimeline";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import ExceptionMessages from "../../../Types/Exception/ExceptionMessages";
@@ -727,6 +728,21 @@ export default class MonitorResourceUtil {
           });
         }
 
+        /*
+         * For grouped metric monitors, work out which breaching series
+         * belong to a resource that is currently inside an ongoing
+         * scheduled maintenance window. Those series are suppressed
+         * below so the monitor keeps alerting on the rest. Computed once
+         * and shared by both the incident and alert paths. Cheap on the
+         * common path: no per-series matches, or no ongoing maintenance,
+         * returns an empty set after at most one query.
+         */
+        const suppressedSeriesFingerprints: Set<string> =
+          await MonitorMaintenanceSuppression.getSuppressedSeriesFingerprints({
+            projectId: monitor.projectId!,
+            matchesPerSeries: response.perSeriesMatches,
+          });
+
         await MonitorIncident.criteriaMetCreateIncidentsAndUpdateMonitorStatus({
           monitor: monitor,
           rootCause: response.rootCause,
@@ -738,6 +754,7 @@ export default class MonitorResourceUtil {
             telemetryQuery: telemetryQuery,
           },
           matchesPerSeries: response.perSeriesMatches,
+          suppressedSeriesFingerprints,
         });
 
         await MonitorAlert.criteriaMetCreateAlertsAndUpdateMonitorStatus({
@@ -751,6 +768,7 @@ export default class MonitorResourceUtil {
             telemetryQuery: telemetryQuery,
           },
           matchesPerSeries: response.perSeriesMatches,
+          suppressedSeriesFingerprints,
         });
       } else if (
         !response.criteriaMetId &&

package/Server/Utils/Monitor/SeriesResourceLabels.ts

@@ -0,0 +1,156 @@
+import { JSONObject } from "../../../Types/JSON";
+
+/*
+ * A grouped metric monitor (e.g. group-by `resource.host.name`) emits
+ * one series per group, and each series carries the group's identity in
+ * its labels. Resource identity shows up under several key spellings:
+ *
+ *   - the raw OTel resource attribute            (`host.name`)
+ *   - the ClickHouse `resource.`-prefixed form   (`resource.host.name`)
+ *   - the OneUptime stamps added at ingest        (`oneuptime.host.id`
+ *     / `oneuptime.host.name` and their `resource.`-prefixed twins)
+ *
+ * This module is the single source of truth for "which label keys
+ * identify which resource type", so that everything keying off series
+ * identity — incident/alert resource linking AND scheduled-maintenance
+ * suppression — stays in agreement. If the two ever diverged, a series
+ * could be linked to a host it is not suppressed for (or vice versa).
+ *
+ * Multi-value labels are flattened, so a series that groups by a
+ * multi-valued attribute references every value it carries.
+ */
+
+export const HostIdLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.host.id",
+  "oneuptime.host.id",
+];
+
+export const HostNameLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.host.name",
+  "oneuptime.host.name",
+  "resource.host.name",
+  "host.name",
+];
+
+/*
+ * For Docker hosts we deliberately ignore raw `host.name` /
+ * `oneuptime.host.name`: those are the Host's territory. The ingest
+ * pipeline stamps `oneuptime.docker.host.*` independently when the
+ * source is a docker host, so only those keys identify a DockerHost.
+ */
+export const DockerHostIdLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.docker.host.id",
+  "oneuptime.docker.host.id",
+];
+
+export const DockerHostNameLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.docker.host.name",
+  "oneuptime.docker.host.name",
+];
+
+export const KubernetesClusterIdLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.kubernetes.cluster.id",
+  "oneuptime.kubernetes.cluster.id",
+];
+
+export const KubernetesClusterNameLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.kubernetes.cluster.name",
+  "oneuptime.kubernetes.cluster.name",
+  "resource.k8s.cluster.name",
+  "k8s.cluster.name",
+];
+
+/*
+ * Services come from OTel-ingested telemetry. The ingest pipeline
+ * auto-creates a Service row keyed by `service.name`, so any series
+ * label carrying that attribute (raw or prefixed) tells us the emitting
+ * service. The `oneuptime.service.id` stamp is also accepted for callers
+ * that resolved the ID upstream.
+ */
+export const ServiceIdLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.service.id",
+  "oneuptime.service.id",
+];
+
+export const ServiceNameLabelKeys: ReadonlyArray<string> = [
+  "resource.service.name",
+  "service.name",
+];
+
+/*
+ * The identifiers carried by one series, split by resource type and by
+ * id-vs-name. Ids are OneUptime database ids (the `oneuptime.*.id`
+ * stamps); names are the human/telemetry identifiers (host.name,
+ * k8s.cluster.name, service.name) that map to a resource's identifier
+ * column (`hostIdentifier`, `clusterIdentifier`, `name`).
+ */
+export interface SeriesResourceRefs {
+  hostIds: Array<string>;
+  hostNames: Array<string>;
+  dockerHostIds: Array<string>;
+  dockerHostNames: Array<string>;
+  kubernetesClusterIds: Array<string>;
+  kubernetesClusterNames: Array<string>;
+  serviceIds: Array<string>;
+  serviceNames: Array<string>;
+}
+
+export default class SeriesResourceLabels {
+  /*
+   * Collect every non-empty string value held at any of `keys` in the
+   * series labels, flattening multi-valued (array) labels. Returns a
+   * deduped list.
+   */
+  public static collectLabelValues(
+    seriesLabels: JSONObject,
+    keys: ReadonlyArray<string>,
+  ): Array<string> {
+    const found: Set<string> = new Set<string>();
+
+    for (const key of keys) {
+      const value: unknown = seriesLabels[key];
+
+      if (typeof value === "string" && value.length > 0) {
+        found.add(value);
+        continue;
+      }
+
+      if (Array.isArray(value)) {
+        for (const item of value) {
+          if (typeof item === "string" && item.length > 0) {
+            found.add(item);
+          }
+        }
+      }
+    }
+
+    return Array.from(found);
+  }
+
+  public static extractResourceRefs(
+    seriesLabels: JSONObject,
+  ): SeriesResourceRefs {
+    return {
+      hostIds: this.collectLabelValues(seriesLabels, HostIdLabelKeys),
+      hostNames: this.collectLabelValues(seriesLabels, HostNameLabelKeys),
+      dockerHostIds: this.collectLabelValues(
+        seriesLabels,
+        DockerHostIdLabelKeys,
+      ),
+      dockerHostNames: this.collectLabelValues(
+        seriesLabels,
+        DockerHostNameLabelKeys,
+      ),
+      kubernetesClusterIds: this.collectLabelValues(
+        seriesLabels,
+        KubernetesClusterIdLabelKeys,
+      ),
+      kubernetesClusterNames: this.collectLabelValues(
+        seriesLabels,
+        KubernetesClusterNameLabelKeys,
+      ),
+      serviceIds: this.collectLabelValues(seriesLabels, ServiceIdLabelKeys),
+      serviceNames: this.collectLabelValues(seriesLabels, ServiceNameLabelKeys),
+    };
+  }
+}

package/Tests/Server/Utils/Monitor/MonitorMaintenanceSuppression.test.ts

@@ -0,0 +1,211 @@
+import MonitorMaintenanceSuppression, {
+  MaintainedResourceKeys,
+} from "../../../../Server/Utils/Monitor/MonitorMaintenanceSuppression";
+import SeriesResourceLabels, {
+  SeriesResourceRefs,
+} from "../../../../Server/Utils/Monitor/SeriesResourceLabels";
+import { JSONObject } from "../../../../Types/JSON";
+import { PerSeriesCriteriaMatch } from "../../../../Types/Probe/ProbeApiIngestResponse";
+
+function emptyMaintained(): MaintainedResourceKeys {
+  return {
+    hosts: { ids: new Set<string>(), names: new Set<string>() },
+    dockerHosts: { ids: new Set<string>(), names: new Set<string>() },
+    kubernetesClusters: { ids: new Set<string>(), names: new Set<string>() },
+    services: { ids: new Set<string>(), names: new Set<string>() },
+  };
+}
+
+function series(
+  fingerprint: string,
+  labels: JSONObject,
+): PerSeriesCriteriaMatch {
+  return {
+    criteriaMetId: "criteria-1",
+    fingerprint,
+    labels,
+    rootCause: "breached",
+  };
+}
+
+describe("SeriesResourceLabels", () => {
+  describe("collectLabelValues", () => {
+    it("returns a string-valued label", () => {
+      expect(
+        SeriesResourceLabels.collectLabelValues({ "host.name": "h1" }, [
+          "host.name",
+        ]),
+      ).toEqual(["h1"]);
+    });
+
+    it("flattens multi-valued labels and dedupes across keys", () => {
+      expect(
+        SeriesResourceLabels.collectLabelValues(
+          { "host.name": ["h1", "h2"], "resource.host.name": "h2" },
+          ["host.name", "resource.host.name"],
+        ).sort(),
+      ).toEqual(["h1", "h2"]);
+    });
+
+    it("ignores empty strings and non-string values", () => {
+      expect(
+        SeriesResourceLabels.collectLabelValues(
+          { "host.name": "", other: 5 as unknown as string },
+          ["host.name", "other"],
+        ),
+      ).toEqual([]);
+    });
+  });
+
+  describe("extractResourceRefs", () => {
+    it("maps host name (prefixed and unprefixed) and id keys", () => {
+      const refs: SeriesResourceRefs = SeriesResourceLabels.extractResourceRefs(
+        {
+          "resource.host.name": "h1",
+          "oneuptime.host.id": "host-id-1",
+        },
+      );
+      expect(refs.hostNames).toEqual(["h1"]);
+      expect(refs.hostIds).toEqual(["host-id-1"]);
+    });
+
+    it("does NOT treat host.name as a docker host (docker keys are distinct)", () => {
+      const refs: SeriesResourceRefs = SeriesResourceLabels.extractResourceRefs(
+        {
+          "host.name": "h1",
+        },
+      );
+      expect(refs.dockerHostNames).toEqual([]);
+      expect(refs.hostNames).toEqual(["h1"]);
+    });
+
+    it("maps docker host, kubernetes cluster, and service keys", () => {
+      const refs: SeriesResourceRefs = SeriesResourceLabels.extractResourceRefs(
+        {
+          "oneuptime.docker.host.name": "d1",
+          "k8s.cluster.name": "c1",
+          "service.name": "s1",
+        },
+      );
+      expect(refs.dockerHostNames).toEqual(["d1"]);
+      expect(refs.kubernetesClusterNames).toEqual(["c1"]);
+      expect(refs.serviceNames).toEqual(["s1"]);
+    });
+  });
+});
+
+describe("MonitorMaintenanceSuppression.getSuppressedFingerprintsForMaintainedResources", () => {
+  it("suppresses only the series whose host is under maintenance", () => {
+    const maintained: MaintainedResourceKeys = emptyMaintained();
+    maintained.hosts.names.add("prod-db-01");
+
+    const result: Set<string> =
+      MonitorMaintenanceSuppression.getSuppressedFingerprintsForMaintainedResources(
+        {
+          matchesPerSeries: [
+            series("fpA", { "resource.host.name": "prod-db-01" }),
+            series("fpB", { "resource.host.name": "prod-web-02" }),
+          ],
+          maintained,
+        },
+      );
+
+    expect(Array.from(result)).toEqual(["fpA"]);
+  });
+
+  it("matches a host by its OneUptime id stamp as well as by name", () => {
+    const maintained: MaintainedResourceKeys = emptyMaintained();
+    maintained.hosts.ids.add("host-uuid-1");
+
+    const result: Set<string> =
+      MonitorMaintenanceSuppression.getSuppressedFingerprintsForMaintainedResources(
+        {
+          matchesPerSeries: [
+            series("fpA", { "oneuptime.host.id": "host-uuid-1" }),
+            series("fpB", { "oneuptime.host.id": "host-uuid-2" }),
+          ],
+          maintained,
+        },
+      );
+
+    expect(Array.from(result)).toEqual(["fpA"]);
+  });
+
+  it("suppresses across docker host, kubernetes cluster, and service resource types", () => {
+    const maintained: MaintainedResourceKeys = emptyMaintained();
+    maintained.dockerHosts.names.add("docker-1");
+    maintained.kubernetesClusters.names.add("cluster-1");
+    maintained.services.names.add("payments");
+
+    const result: Set<string> =
+      MonitorMaintenanceSuppression.getSuppressedFingerprintsForMaintainedResources(
+        {
+          matchesPerSeries: [
+            series("fpDocker", { "oneuptime.docker.host.name": "docker-1" }),
+            series("fpCluster", { "k8s.cluster.name": "cluster-1" }),
+            series("fpService", { "service.name": "payments" }),
+            series("fpClear", { "service.name": "billing" }),
+          ],
+          maintained,
+        },
+      );
+
+    expect(Array.from(result).sort()).toEqual([
+      "fpCluster",
+      "fpDocker",
+      "fpService",
+    ]);
+  });
+
+  it("does not cross-match resource types that happen to share a name", () => {
+    /*
+     * A service named the same string as the breaching host must not
+     * suppress the host's series.
+     */
+    const maintained: MaintainedResourceKeys = emptyMaintained();
+    maintained.services.names.add("prod-db-01");
+
+    const result: Set<string> =
+      MonitorMaintenanceSuppression.getSuppressedFingerprintsForMaintainedResources(
+        {
+          matchesPerSeries: [
+            series("fpHost", { "resource.host.name": "prod-db-01" }),
+          ],
+          maintained,
+        },
+      );
+
+    expect(result.size).toBe(0);
+  });
+
+  it("returns an empty set when nothing is under maintenance", () => {
+    const result: Set<string> =
+      MonitorMaintenanceSuppression.getSuppressedFingerprintsForMaintainedResources(
+        {
+          matchesPerSeries: [
+            series("fpA", { "resource.host.name": "prod-db-01" }),
+          ],
+          maintained: emptyMaintained(),
+        },
+      );
+
+    expect(result.size).toBe(0);
+  });
+
+  it("skips series with no fingerprint without throwing", () => {
+    const maintained: MaintainedResourceKeys = emptyMaintained();
+    maintained.hosts.names.add("prod-db-01");
+
+    const result: Set<string> =
+      MonitorMaintenanceSuppression.getSuppressedFingerprintsForMaintainedResources(
+        {
+          matchesPerSeries: [
+            series("", { "resource.host.name": "prod-db-01" }),
+          ],
+          maintained,
+        },
+      );
+
+    expect(result.size).toBe(0);
+  });
+});

package/build/dist/Models/DatabaseModels/KubernetesResource.js

@@ -82,6 +82,7 @@ let KubernetesResource = class KubernetesResource extends BaseModel {
         this.controllerCronJobName = undefined;
         this.latestCpuPercent = undefined;
         this.latestMemoryBytes = undefined;
+        this.latestMemoryPercent = undefined;
         this.metricsUpdatedAt = undefined;
         this.lastSeenAt = undefined;
         this.resourceCreationTimestamp = undefined;
@@ -578,6 +579,43 @@ __decorate([
     }),
     __metadata("design:type", Number)
 ], KubernetesResource.prototype, "latestMemoryBytes", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: READ_PERMISSIONS,
+        update: [],
+    }),
+    TableColumn({
+        required: false,
+        type: TableColumnType.Number,
+        canReadOnRelationQuery: true,
+        title: "Latest Memory Percent",
+        description: "Most recent memory usage as a percent of the resource's node allocatable memory (Pod or Node). Stored as decimal — mirrors latestCpuPercent — so the workload/namespace list views can SUM a per-pod percentage. Null until the first metric arrives or while the node's allocatable memory is still unknown.",
+    }),
+    Column({
+        nullable: true,
+        type: ColumnType.Decimal,
+        transformer: {
+            to: (value) => {
+                if (value === null || value === undefined) {
+                    return null;
+                }
+                return value;
+            },
+            from: (value) => {
+                if (value === null || value === undefined) {
+                    return null;
+                }
+                if (typeof value === "number") {
+                    return value;
+                }
+                const parsed = parseFloat(value);
+                return isNaN(parsed) ? null : parsed;
+            },
+        },
+    }),
+    __metadata("design:type", Number)
+], KubernetesResource.prototype, "latestMemoryPercent", void 0);
 __decorate([
     ColumnAccessControl({
         create: [],