test(callbackauthn): pin the auth domain POST/GET roundtrip contract

Clients like the terraform provider land state via a follow-up GET after
every write, so the responses must round-trip posted values exactly. The
parametrized cases pin that contract per kind, including the server-side
defaulting (attribute/claim mappings, zero-value scalars) and role-name
normalization (EDITOR -> signoz-editor, null groupMappings).

docs/api/openapi.yml

@@ -464,27 +464,50 @@ components:
           type: string
       type: object
     AuthtypesAuthDomainConfig:
+      discriminator:
+        mapping:
+          google: '#/components/schemas/AuthtypesAuthDomainConfigGoogle'
+          oidc: '#/components/schemas/AuthtypesAuthDomainConfigOIDC'
+          saml: '#/components/schemas/AuthtypesAuthDomainConfigSAML'
+        propertyName: kind
       oneOf:
-      - $ref: '#/components/schemas/AuthtypesSamlConfig'
-      - $ref: '#/components/schemas/AuthtypesGoogleConfig'
-      - $ref: '#/components/schemas/AuthtypesOIDCConfig'
+      - $ref: '#/components/schemas/AuthtypesAuthDomainConfigSAML'
+      - $ref: '#/components/schemas/AuthtypesAuthDomainConfigGoogle'
+      - $ref: '#/components/schemas/AuthtypesAuthDomainConfigOIDC'
+      type: object
+    AuthtypesAuthDomainConfigGoogle:
       properties:
-        googleAuthConfig:
-          $ref: '#/components/schemas/AuthtypesGoogleConfig'
-        oidcConfig:
-          $ref: '#/components/schemas/AuthtypesOIDCConfig'
-        roleMapping:
-          $ref: '#/components/schemas/AuthtypesRoleMapping'
-        samlConfig:
-          $ref: '#/components/schemas/AuthtypesSamlConfig'
-        ssoEnabled:
-          type: boolean
-        ssoType:
+        kind:
           $ref: '#/components/schemas/AuthtypesAuthNProvider'
+        spec:
+          $ref: '#/components/schemas/AuthtypesGoogleConfig'
+      required:
+      - kind
+      - spec
+      type: object
+    AuthtypesAuthDomainConfigOIDC:
+      properties:
+        kind:
+          $ref: '#/components/schemas/AuthtypesAuthNProvider'
+        spec:
+          $ref: '#/components/schemas/AuthtypesOIDCConfig'
+      required:
+      - kind
+      - spec
+      type: object
+    AuthtypesAuthDomainConfigSAML:
+      properties:
+        kind:
+          $ref: '#/components/schemas/AuthtypesAuthNProvider'
+        spec:
+          $ref: '#/components/schemas/AuthtypesSamlConfig'
+      required:
+      - kind
+      - spec
       type: object
     AuthtypesAuthNProvider:
       enum:
-      - google_auth
+      - google
       - saml
       - email_password
       - oidc
@@ -531,12 +554,16 @@ components:
         createdAt:
           format: date-time
           type: string
+        enabled:
+          type: boolean
         id:
           type: string
         name:
           type: string
         orgId:
           type: string
+        roleMapping:
+          $ref: '#/components/schemas/AuthtypesRoleMapping'
         updatedAt:
           format: date-time
           type: string
@@ -616,6 +643,9 @@ components:
           type: string
         serviceAccountJson:
           type: string
+      required:
+      - clientId
+      - clientSecret
       type: object
     AuthtypesOIDCConfig:
       properties:
@@ -633,6 +663,10 @@ components:
           type: string
         issuerAlias:
           type: string
+      required:
+      - issuer
+      - clientId
+      - clientSecret
       type: object
     AuthtypesOrgSessionContext:
       properties:
@@ -654,8 +688,15 @@ components:
       properties:
         config:
           $ref: '#/components/schemas/AuthtypesAuthDomainConfig'
+        enabled:
+          type: boolean
         name:
           type: string
+        roleMapping:
+          $ref: '#/components/schemas/AuthtypesRoleMapping'
+      required:
+      - name
+      - config
       type: object
     AuthtypesPostableEmailPasswordSession:
       properties:
@@ -762,14 +803,18 @@ components:
       properties:
         attributeMapping:
           $ref: '#/components/schemas/AuthtypesAttributeMapping'
+        certificate:
+          type: string
+        entityId:
+          type: string
         insecureSkipAuthNRequestsSigned:
           type: boolean
-        samlCert:
-          type: string
-        samlEntity:
-          type: string
-        samlIdp:
+        location:
           type: string
+      required:
+      - entityId
+      - location
+      - certificate
       type: object
     AuthtypesSessionContext:
       properties:
@@ -809,6 +854,12 @@ components:
       properties:
         config:
           $ref: '#/components/schemas/AuthtypesAuthDomainConfig'
+        enabled:
+          type: boolean
+        roleMapping:
+          $ref: '#/components/schemas/AuthtypesRoleMapping'
+      required:
+      - config
       type: object
     AuthtypesUpdatableRole:
       properties:
@@ -4212,21 +4263,6 @@ components:
       - missingOptionalMetrics
       - missingRequiredAttributes
       type: object
-    InframonitoringtypesClusterFilter:
-      properties:
-        expression:
-          type: string
-        filterByNodeReadiness:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesNodeCondition'
-          nullable: true
-          type: array
-        filterByPodStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesClusterRecord:
       properties:
         clusterCPU:
@@ -4364,16 +4400,6 @@ components:
       - containerCannotRun
       - unknown
       type: object
-    InframonitoringtypesContainerFilter:
-      properties:
-        expression:
-          type: string
-        filterByContainerStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesContainerStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesContainerReady:
       enum:
       - ready
@@ -4473,16 +4499,6 @@ components:
       - total
       - endTimeBeforeRetention
       type: object
-    InframonitoringtypesDaemonSetFilter:
-      properties:
-        expression:
-          type: string
-        filterByPodStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesDaemonSetRecord:
       properties:
         currentNodes:
@@ -4555,16 +4571,6 @@ components:
       - total
       - endTimeBeforeRetention
       type: object
-    InframonitoringtypesDeploymentFilter:
-      properties:
-        expression:
-          type: string
-        filterByPodStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesDeploymentRecord:
       properties:
         availablePods:
@@ -4706,16 +4712,6 @@ components:
       - total
       - endTimeBeforeRetention
       type: object
-    InframonitoringtypesJobFilter:
-      properties:
-        expression:
-          type: string
-        filterByPodStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesJobRecord:
       properties:
         activePods:
@@ -4839,16 +4835,6 @@ components:
       - message
       - documentationLink
       type: object
-    InframonitoringtypesNamespaceFilter:
-      properties:
-        expression:
-          type: string
-        filterByPodStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesNamespaceRecord:
       properties:
         counts:
@@ -4930,21 +4916,6 @@ components:
       - ready
       - notReady
       type: object
-    InframonitoringtypesNodeFilter:
-      properties:
-        expression:
-          type: string
-        filterByNodeReadiness:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesNodeCondition'
-          nullable: true
-          type: array
-        filterByPodStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesNodeRecord:
       properties:
         condition:
@@ -5061,16 +5032,6 @@ components:
       - shutdown
       - unexpectedAdmissionError
       type: object
-    InframonitoringtypesPodFilter:
-      properties:
-        expression:
-          type: string
-        filterByPodStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesPodRecord:
       properties:
         meta:
@@ -5170,7 +5131,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesClusterFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5196,7 +5157,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesContainerFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5222,7 +5183,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesDaemonSetFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5248,7 +5209,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesDeploymentFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5300,7 +5261,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesJobFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5326,7 +5287,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesNamespaceFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5352,7 +5313,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesNodeFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5378,7 +5339,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesPodFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5404,7 +5365,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/InframonitoringtypesStatefulSetFilter'
+          $ref: '#/components/schemas/Querybuildertypesv5Filter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5455,16 +5416,6 @@ components:
       - list
       - grouped_list
       type: string
-    InframonitoringtypesStatefulSetFilter:
-      properties:
-        expression:
-          type: string
-        filterByPodStatus:
-          items:
-            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
-          nullable: true
-          type: array
-      type: object
     InframonitoringtypesStatefulSetRecord:
       properties:
         currentPods:
@@ -10611,275 +10562,6 @@ paths:
       summary: Update public dashboard
       tags:
       - dashboard
-  /api/v1/domains:
-    get:
-      deprecated: false
-      description: This endpoint lists all auth domains
-      operationId: ListAuthDomains
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    items:
-                      $ref: '#/components/schemas/AuthtypesGettableAuthDomain'
-                    type: array
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: List all auth domains
-      tags:
-      - authdomains
-    post:
-      deprecated: false
-      description: This endpoint creates an auth domain
-      operationId: CreateAuthDomain
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AuthtypesPostableAuthDomain'
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/TypesIdentifiable'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: Created
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "409":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Conflict
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Create auth domain
-      tags:
-      - authdomains
-  /api/v1/domains/{id}:
-    delete:
-      deprecated: false
-      description: This endpoint deletes an auth domain
-      operationId: DeleteAuthDomain
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "204":
-          description: No Content
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Delete auth domain
-      tags:
-      - authdomains
-    get:
-      deprecated: false
-      description: This endpoint returns an auth domain by ID
-      operationId: GetAuthDomain
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/AuthtypesGettableAuthDomain'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Get auth domain by ID
-      tags:
-      - authdomains
-    put:
-      deprecated: false
-      description: This endpoint updates an auth domain
-      operationId: UpdateAuthDomain
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AuthtypesUpdatableAuthDomain'
-      responses:
-        "204":
-          description: No Content
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "409":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Conflict
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Update auth domain
-      tags:
-      - authdomains
   /api/v1/downtime_schedules:
     get:
       deprecated: false
@@ -14904,6 +14586,275 @@ paths:
       summary: Update user preference
       tags:
       - preferences
+  /api/v2/auth_domains:
+    get:
+      deprecated: false
+      description: This endpoint lists all auth domains
+      operationId: ListAuthDomains
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    items:
+                      $ref: '#/components/schemas/AuthtypesGettableAuthDomain'
+                    type: array
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: List all auth domains
+      tags:
+      - authdomains
+    post:
+      deprecated: false
+      description: This endpoint creates an auth domain
+      operationId: CreateAuthDomain
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuthtypesPostableAuthDomain'
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/TypesIdentifiable'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: Created
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Conflict
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: Create auth domain
+      tags:
+      - authdomains
+  /api/v2/auth_domains/{id}:
+    delete:
+      deprecated: false
+      description: This endpoint deletes an auth domain
+      operationId: DeleteAuthDomain
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: Delete auth domain
+      tags:
+      - authdomains
+    get:
+      deprecated: false
+      description: This endpoint returns an auth domain by ID
+      operationId: GetAuthDomain
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/AuthtypesGettableAuthDomain'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: Get auth domain by ID
+      tags:
+      - authdomains
+    put:
+      deprecated: false
+      description: This endpoint updates an auth domain
+      operationId: UpdateAuthDomain
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuthtypesUpdatableAuthDomain'
+      responses:
+        "204":
+          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "409":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Conflict
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - ADMIN
+      - tokenizer:
+        - ADMIN
+      summary: Update auth domain
+      tags:
+      - authdomains
   /api/v2/dashboard_views:
     get:
       deprecated: false

docs/contributing/go/handler.md

@@ -349,7 +349,7 @@ func (Step) JSONSchema() (jsonschema.Schema, error) {
 
 ### `oneOf` with a discriminator
 
-For a sum type whose variants are keyed by a property (e.g. `kind`), expose the variants via `JSONSchemaOneOf()` and add a discriminator. Without it, code generators intersect the variants (`A & B & C`) instead of producing a clean discriminated union (`A | B | C`).
+For a sum type whose variants are keyed by a property (e.g. `kind`), expose the variants via `JSONSchemaOneOf()` and add a discriminator. Without it, code generators intersect the variants (`A & B & C`) instead of producing a clean discriminated union (`A | B | C`). How to model the sum type itself is covered in [types.md](types.md#sum-types-the-kindspec-envelope) — this section is only about its schema.
 
 The parent keeps its `JSONSchemaOneOf()` (the `oneOf` itself) and *additionally* tags it via `PrepareJSONSchema` with the `x-signoz-discriminator` extension; `signoz.attachDiscriminators` then promotes that marker to a real OpenAPI 3 `discriminator` (and strips the duplicate parent properties) after reflection.
 

docs/contributing/go/types.md

@@ -61,31 +61,37 @@ type Channel struct {
 
 ```go
 type AuthDomain struct {
-    storableAuthDomain *StorableAuthDomain
-    authDomainConfig   *AuthDomainConfig
+    storableAuthDomain       *StorableAuthDomain
+    storableAuthDomainConfig *StorableAuthDomainConfig
 }
 
 type StorableAuthDomain struct {
     bun.BaseModel `bun:"table:auth_domain"`
     types.Identifiable
     Name  string      `bun:"name"`
-    Data  string      `bun:"data"`  // AuthDomainConfig serialized as JSON
+    Data  string      `bun:"data"`  // StorableAuthDomainConfig serialized as JSON
     OrgID valuer.UUID `bun:"org_id"`
     types.TimeAuditable
 }
 
 type PostableAuthDomain struct {
-    Config AuthDomainConfig `json:"config"`
-    Name   string           `json:"name"`
+    Name        string           `json:"name" required:"true"`
+    Enabled     bool             `json:"enabled"`
+    Config      AuthDomainConfig `json:"config" required:"true"`
+    RoleMapping *RoleMapping     `json:"roleMapping"`
 }
 
-type UpdateableAuthDomain struct {
-    Config AuthDomainConfig `json:"config"` // Name intentionally absent
+type UpdatableAuthDomain struct {
+    Enabled     bool             `json:"enabled"` // Name intentionally absent
+    Config      AuthDomainConfig `json:"config" required:"true"`
+    RoleMapping *RoleMapping     `json:"roleMapping"`
 }
 
 type GettableAuthDomain struct {
-    *StorableAuthDomain
-    *AuthDomainConfig
+    StorableAuthDomain
+    Enabled           bool               `json:"enabled"`
+    Config            AuthDomainConfig   `json:"config"`
+    RoleMapping       *RoleMapping       `json:"roleMapping"`
     AuthNProviderInfo *AuthNProviderInfo `json:"authNProviderInfo"`
 }
 ```
@@ -93,11 +99,74 @@ type GettableAuthDomain struct {
 Each flavor exists for a concrete reason:
 
 - `StorableAuthDomain` stores the typed config as an opaque `Data string` column, so the schema does not need to migrate every time a config field is added.
-- `PostableAuthDomain` carries the config as a structured object (not a string) for the request.
-- `UpdateableAuthDomain` excludes `Name` because a domain's name cannot change after creation.
+- `PostableAuthDomain` carries the config as a structured object (not a string) for the request. `AuthDomainConfig` is a kind/spec envelope — see the next section.
+- `UpdatableAuthDomain` excludes `Name` because a domain's name cannot change after creation.
 - `GettableAuthDomain` adds `AuthNProviderInfo`, which is derived at read time and never persisted.
 
-The core `AuthDomain` holds the two live halves — `storableAuthDomain` and `authDomainConfig` — and owns business methods such as `Update(config)`. Conversions use the `New<Output>From<Input>` form: `NewAuthDomainFromConfig`, `NewAuthDomainFromStorableAuthDomain`, `NewGettableAuthDomainFromAuthDomain`.
+The core `AuthDomain` holds the two live halves — `storableAuthDomain` and `storableAuthDomainConfig` — and owns business methods such as `Update(updatable)`. Conversions use the `New<Output>From<Input>` form: `NewAuthDomainFromPostableAuthDomain`, `NewAuthDomainFromStorableAuthDomain`, `NewGettableAuthDomainFromAuthDomain`.
+
+## Sum types: the kind/spec envelope
+
+When a domain type is a *sum type* — exactly one of several variants, selected by a discriminator — model it as an envelope with a `kind` and a `spec`:
+
+```go
+type AuthDomainConfig struct {
+    Kind AuthNProvider `json:"kind" required:"true"`
+    Spec any           `json:"spec" required:"true"`
+}
+```
+
+```json
+{ "kind": "saml", "spec": { "entityId": "...", "location": "...", "certificate": "..." } }
+```
+
+`Kind` is a `valuer.String` enum implementing `Enum()`; `Spec` holds exactly one concrete variant type. `RuleThresholdData` and `EvaluationEnvelope` in `pkg/types/ruletypes/` and `AuthDomainConfig` in `pkg/types/authtypes/` are the canonical examples. (`QueryEnvelope` in querybuildertypes uses `type` as the discriminator key for historical reasons; new envelopes use `kind`.)
+
+### The envelope goes at the point of variance, not the resource root
+
+Put the envelope on the field that actually varies. The resource root is almost never a sum type — an auth domain always has a `name`, `enabled`, and `roleMapping` regardless of provider; only its provider configuration varies, so the envelope is the `config` field:
+
+```json
+{ "name": "signoz.io", "enabled": true, "config": { "kind": "saml", "spec": { "..." : "..." } }, "roleMapping": null }
+```
+
+Hoisting `kind`/`spec` to the root would turn the whole resource into a `oneOf`: every flavor (`PostableX`, `UpdatableX`, `GettableX`) then needs one variant schema per kind, each repeating the common fields; every new common field has to be added to all of them; and generated clients get unions of large objects instead of one small union that narrows on `config.kind`. A root-level `kind` also collides with the resource-model meaning of the word — in the Kubernetes/Perses model, root `kind` answers "what resource is this" (`Dashboard`), never "which flavor of config does it hold".
+
+The other domains already follow this placement:
+
+- **Rules** — plain root; envelopes on the varying fields: `thresholds: {kind, spec}` and `evaluation: {kind, spec}`.
+- **Dashboards** — Perses resource model: metadata at the root plus one typed `spec`; the unions sit deep inside, at each panel/query/variable plugin (`{kind, spec}` in `perses_plugin_wrappers.go`).
+- **Saved views** — root `{schemaVersion, spec}`, where `spec` is a *versioning* envelope holding one fixed type, not a union; the unions are inside it (`spec.queries: [{type, spec}]`). Same word, different job — a versioned body is not a discriminated union.
+
+### Why this tagging style
+
+Of the union encodings in common use, the envelope is the *adjacently tagged* one — tag and payload side by side — as used by the Kubernetes resource model, Perses plugins, CloudFormation (`Type` + `Properties`), and Grafana provisioning (`type` + `settings`). Variant payloads stay collision-free, and each kind maps to a named wrapper schema that carries the discriminator, which is exactly what OpenAPI generators need. The alternatives lose on those points: *internally tagged* (`{"type": "saml", ...fields flattened}` — Stripe, GitHub webhooks) mixes common and variant fields, admits cross-variant key collisions, and forces every variant schema to redeclare the discriminator; *sibling optional fields* (`{"type": "saml", "samlConfig": {}, "oidcConfig": {}}` — classic Kubernetes `VolumeSource`, and the pre-envelope auth domain) is the anti-pattern the first rule below exists to prevent.
+
+The rules that make the envelope work:
+
+- **Never model variants as sibling fields.** A struct with `SAML *SamlConfig`, `Google *GoogleConfig`, `OIDC *OIDCConfig` next to a discriminator cannot be expressed as an OpenAPI discriminated union, forces nilability checks on every consumer, and silently admits contradictory payloads (kind=saml with a google config). The chosen variant *is* the payload.
+- **The envelope owns `UnmarshalJSON`.** Decode `kind` first, then switch on it to decode and validate the matching concrete type into `Spec`. Unknown kinds and missing specs are rejected at the boundary:
+
+    ```go
+    func (typ *AuthDomainConfig) UnmarshalJSON(data []byte) error {
+        var raw map[string]json.RawMessage
+        // ... unmarshal raw, decode raw["kind"] ...
+        switch kind {
+        case AuthNProviderSAML:
+            spec := SamlConfig{}
+            if err := json.Unmarshal(raw["spec"], &spec); err != nil {
+                return err
+            }
+            typ.Spec = spec
+        // ... one case per kind, default rejects ...
+        }
+        typ.Kind = kind
+        return nil
+    }
+    ```
+- **Consumers type-assert on `Spec`** (`config.Spec.(SamlConfig)`) after switching on `Kind`. If assertion sites multiply, add typed accessors on the envelope (see `EvaluationEnvelope.GetEvaluation()`).
+- **OpenAPI needs one unexported variant struct per kind** (`authDomainConfigSAML{Kind; Spec SamlConfig}`), exposed via `JSONSchemaOneOf()` and mapped via `PrepareJSONSchema` with the `x-signoz-discriminator` extension. The schema mechanics are covered in [handler.md](handler.md#oneof-with-a-discriminator).
+- **A persisted legacy shape stays in a `StorableX`.** If rows were written before the envelope existed, keep the old JSON shape in a storable type (`StorableAuthDomainConfig` keeps `ssoType` + sibling configs) and convert to/from the envelope at the type boundary — the data layer never changes shape retroactively.
 
 ## Conventions that tie the flavors together
 
@@ -139,6 +208,8 @@ Both are optional. Do not introduce them if `PostableX` already covers the case.
 
 - Every domain package defines the core type `X`. Only `X` is mandatory.
 - Add `PostableX` / `GettableX` / `UpdatableX` / `StorableX` one at a time, only when the shape actually diverges from `X`.
+- Model sum types as a `{kind, spec}` envelope with a validating `UnmarshalJSON` — never as sibling variant fields next to a discriminator.
+- The envelope goes on the field that varies, never at the resource root — common fields stay on the resource, outside the union.
 - Domain logic lives on `X`, not on the flavor types.
 - Conversions can be a `New<Output>From<Input>` constructor or a receiver-style `ToY()` method — pick whichever reads best at the call site.
 - Use a type alias when two shapes are truly identical.

ee/authn/callbackauthn/oidccallbackauthn/authn.go

@@ -53,7 +53,7 @@ func New(store authtypes.AuthNStore, licensing licensing.Licensing, providerSett
 }
 
 func (a *AuthN) LoginURL(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (string, error) {
-	if authDomain.AuthDomainConfig().AuthNProvider != authtypes.AuthNProviderOIDC {
+	if authDomain.StorableAuthDomainConfig().AuthNProvider != authtypes.AuthNProviderOIDC {
 		return "", errors.Newf(errors.TypeInternal, authtypes.ErrCodeAuthDomainMismatch, "domain type is not oidc")
 	}
 
@@ -106,14 +106,14 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, err
 	}
 
-	if claims == nil && authDomain.AuthDomainConfig().OIDC.GetUserInfo {
+	if claims == nil && authDomain.StorableAuthDomainConfig().OIDC.GetUserInfo {
 		claims, err = a.claimsFromUserInfo(ctx, oidcProvider, token)
 		if err != nil {
 			return nil, err
 		}
 	}
 
-	emailClaim, ok := claims[authDomain.AuthDomainConfig().OIDC.ClaimMapping.Email].(string)
+	emailClaim, ok := claims[authDomain.StorableAuthDomainConfig().OIDC.ClaimMapping.Email].(string)
 	if !ok {
 		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: missing email in claims")
 	}
@@ -123,7 +123,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: failed to parse email").WithAdditional(err.Error())
 	}
 
-	if !authDomain.AuthDomainConfig().OIDC.InsecureSkipEmailVerified {
+	if !authDomain.StorableAuthDomainConfig().OIDC.InsecureSkipEmailVerified {
 		emailVerifiedClaim, ok := claims["email_verified"].(bool)
 		if !ok {
 			return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: missing email_verified in claims")
@@ -135,14 +135,14 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 	}
 
 	name := ""
-	if nameClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Name; nameClaim != "" {
+	if nameClaim := authDomain.StorableAuthDomainConfig().OIDC.ClaimMapping.Name; nameClaim != "" {
 		if n, ok := claims[nameClaim].(string); ok {
 			name = n
 		}
 	}
 
 	var groups []string
-	if groupsClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Groups; groupsClaim != "" {
+	if groupsClaim := authDomain.StorableAuthDomainConfig().OIDC.ClaimMapping.Groups; groupsClaim != "" {
 		if claimValue, exists := claims[groupsClaim]; exists {
 			switch g := claimValue.(type) {
 			case []any:
@@ -161,7 +161,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 	}
 
 	role := ""
-	if roleClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Role; roleClaim != "" {
+	if roleClaim := authDomain.StorableAuthDomainConfig().OIDC.ClaimMapping.Role; roleClaim != "" {
 		if r, ok := claims[roleClaim].(string); ok {
 			role = r
 		}
@@ -177,11 +177,11 @@ func (a *AuthN) ProviderInfo(ctx context.Context, authDomain *authtypes.AuthDoma
 }
 
 func (a *AuthN) oidcProviderAndoauth2Config(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (*oidc.Provider, *oauth2.Config, error) {
-	if authDomain.AuthDomainConfig().OIDC.IssuerAlias != "" {
-		ctx = oidc.InsecureIssuerURLContext(ctx, authDomain.AuthDomainConfig().OIDC.IssuerAlias)
+	if authDomain.StorableAuthDomainConfig().OIDC.IssuerAlias != "" {
+		ctx = oidc.InsecureIssuerURLContext(ctx, authDomain.StorableAuthDomainConfig().OIDC.IssuerAlias)
 	}
 
-	oidcProvider, err := oidc.NewProvider(ctx, authDomain.AuthDomainConfig().OIDC.Issuer)
+	oidcProvider, err := oidc.NewProvider(ctx, authDomain.StorableAuthDomainConfig().OIDC.Issuer)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -189,13 +189,13 @@ func (a *AuthN) oidcProviderAndoauth2Config(ctx context.Context, siteURL *url.UR
 	scopes := make([]string, len(defaultScopes))
 	copy(scopes, defaultScopes)
 
-	if authDomain.AuthDomainConfig().RoleMapping != nil && len(authDomain.AuthDomainConfig().RoleMapping.GroupMappings) > 0 {
+	if authDomain.StorableAuthDomainConfig().RoleMapping != nil && len(authDomain.StorableAuthDomainConfig().RoleMapping.GroupMappings) > 0 {
 		scopes = append(scopes, "groups")
 	}
 
 	return oidcProvider, &oauth2.Config{
-		ClientID:     authDomain.AuthDomainConfig().OIDC.ClientID,
-		ClientSecret: authDomain.AuthDomainConfig().OIDC.ClientSecret,
+		ClientID:     authDomain.StorableAuthDomainConfig().OIDC.ClientID,
+		ClientSecret: authDomain.StorableAuthDomainConfig().OIDC.ClientSecret,
 		Endpoint:     oidcProvider.Endpoint(),
 		Scopes:       scopes,
 		RedirectURL: (&url.URL{
@@ -212,7 +212,7 @@ func (a *AuthN) claimsFromIDToken(ctx context.Context, authDomain *authtypes.Aut
 		return nil, errors.New(errors.TypeNotFound, errors.CodeNotFound, "oidc: no id_token in token response")
 	}
 
-	verifier := provider.Verifier(&oidc.Config{ClientID: authDomain.AuthDomainConfig().OIDC.ClientID})
+	verifier := provider.Verifier(&oidc.Config{ClientID: authDomain.StorableAuthDomainConfig().OIDC.ClientID})
 	idToken, err := verifier.Verify(ctx, rawIDToken)
 	if err != nil {
 		return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "oidc: failed to verify token").WithAdditional(err.Error())

ee/authn/callbackauthn/samlcallbackauthn/authn.go

@@ -40,7 +40,7 @@ func New(ctx context.Context, store authtypes.AuthNStore, licensing licensing.Li
 }
 
 func (a *AuthN) LoginURL(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (string, error) {
-	if authDomain.AuthDomainConfig().AuthNProvider != authtypes.AuthNProviderSAML {
+	if authDomain.StorableAuthDomainConfig().AuthNProvider != authtypes.AuthNProviderSAML {
 		return "", errors.Newf(errors.TypeInternal, authtypes.ErrCodeAuthDomainMismatch, "saml: domain type is not saml")
 	}
 
@@ -101,19 +101,19 @@ func (a *AuthN) HandleCallback(ctx context.Context, formValues url.Values) (*aut
 	}
 
 	name := ""
-	if nameAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Name; nameAttribute != "" {
+	if nameAttribute := authDomain.StorableAuthDomainConfig().SAML.AttributeMapping.Name; nameAttribute != "" {
 		if val := assertionInfo.Values.Get(nameAttribute); val != "" {
 			name = val
 		}
 	}
 
 	var groups []string
-	if groupAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Groups; groupAttribute != "" {
+	if groupAttribute := authDomain.StorableAuthDomainConfig().SAML.AttributeMapping.Groups; groupAttribute != "" {
 		groups = assertionInfo.Values.GetAll(groupAttribute)
 	}
 
 	role := ""
-	if roleAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Role; roleAttribute != "" {
+	if roleAttribute := authDomain.StorableAuthDomainConfig().SAML.AttributeMapping.Role; roleAttribute != "" {
 		if val := assertionInfo.Values.Get(roleAttribute); val != "" {
 			role = val
 		}
@@ -142,11 +142,11 @@ func (a *AuthN) serviceProvider(siteURL *url.URL, authDomain *authtypes.AuthDoma
 	// The ServiceProviderIssuer is the client id in case of keycloak. Since we set it to the host here, we need to set the client id == host in keycloak.
 	// For AWSSSO, this is the value of Application SAML audience.
 	return &saml2.SAMLServiceProvider{
-		IdentityProviderSSOURL:      authDomain.AuthDomainConfig().SAML.SamlIdp,
-		IdentityProviderIssuer:      authDomain.AuthDomainConfig().SAML.SamlEntity,
+		IdentityProviderSSOURL:      authDomain.StorableAuthDomainConfig().SAML.Location,
+		IdentityProviderIssuer:      authDomain.StorableAuthDomainConfig().SAML.EntityID,
 		ServiceProviderIssuer:       siteURL.Host,
 		AssertionConsumerServiceURL: acsURL.String(),
-		SignAuthnRequests:           !authDomain.AuthDomainConfig().SAML.InsecureSkipAuthNRequestsSigned,
+		SignAuthnRequests:           !authDomain.StorableAuthDomainConfig().SAML.InsecureSkipAuthNRequestsSigned,
 		AllowMissingAttributes:      true,
 		IDPCertificateStore:         certStore,
 		SPKeyStore:                  dsig.RandomKeyStoreForTest(),
@@ -159,15 +159,15 @@ func (a *AuthN) getCertificateStore(authDomain *authtypes.AuthDomain) (dsig.X509
 	}
 
 	var certBytes []byte
-	if strings.Contains(authDomain.AuthDomainConfig().SAML.SamlCert, "-----BEGIN CERTIFICATE-----") {
-		block, _ := pem.Decode([]byte(authDomain.AuthDomainConfig().SAML.SamlCert))
+	if strings.Contains(authDomain.StorableAuthDomainConfig().SAML.Certificate, "-----BEGIN CERTIFICATE-----") {
+		block, _ := pem.Decode([]byte(authDomain.StorableAuthDomainConfig().SAML.Certificate))
 		if block == nil {
 			return certStore, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "no valid pem cert found")
 		}
 
 		certBytes = block.Bytes
 	} else {
-		certData, err := base64.StdEncoding.DecodeString(authDomain.AuthDomainConfig().SAML.SamlCert)
+		certData, err := base64.StdEncoding.DecodeString(authDomain.StorableAuthDomainConfig().SAML.Certificate)
 		if err != nil {
 			return certStore, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to read certificate: %s", err.Error())
 		}

frontend/src/api/generated/services/authdomains/index.ts

@@ -38,14 +38,14 @@ import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
  */
 export const listAuthDomains = (signal?: AbortSignal) => {
 	return GeneratedAPIInstance<ListAuthDomains200>({
-		url: `/api/v1/domains`,
+		url: `/api/v2/auth_domains`,
 		method: 'GET',
 		signal,
 	});
 };
 
 export const getListAuthDomainsQueryKey = () => {
-	return [`/api/v1/domains`] as const;
+	return [`/api/v2/auth_domains`] as const;
 };
 
 export const getListAuthDomainsQueryOptions = <
@@ -125,7 +125,7 @@ export const createAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<CreateAuthDomain201>({
-		url: `/api/v1/domains`,
+		url: `/api/v2/auth_domains`,
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
 		data: authtypesPostableAuthDomainDTO,
@@ -208,7 +208,7 @@ export const deleteAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<void>({
-		url: `/api/v1/domains/${id}`,
+		url: `/api/v2/auth_domains/${id}`,
 		method: 'DELETE',
 		signal,
 	});
@@ -287,7 +287,7 @@ export const getAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<GetAuthDomain200>({
-		url: `/api/v1/domains/${id}`,
+		url: `/api/v2/auth_domains/${id}`,
 		method: 'GET',
 		signal,
 	});
@@ -296,7 +296,7 @@ export const getAuthDomain = (
 export const getGetAuthDomainQueryKey = ({
 	id,
 }: GetAuthDomainPathParameters) => {
-	return [`/api/v1/domains/${id}`] as const;
+	return [`/api/v2/auth_domains/${id}`] as const;
 };
 
 export const getGetAuthDomainQueryOptions = <
@@ -389,7 +389,7 @@ export const updateAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<void>({
-		url: `/api/v1/domains/${id}`,
+		url: `/api/v2/auth_domains/${id}`,
 		method: 'PUT',
 		headers: { 'Content-Type': 'application/json' },
 		data: authtypesUpdatableAuthDomainDTO,

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -1861,8 +1861,19 @@ export interface AuthtypesAttributeMappingDTO {
 	role?: string;
 }
 
+export enum AuthtypesAuthDomainConfigSAMLDTOKind {
+	saml = 'saml',
+}
 export interface AuthtypesSamlConfigDTO {
 	attributeMapping?: AuthtypesAttributeMappingDTO;
+	/**
+	 * @type string
+	 */
+	certificate: string;
+	/**
+	 * @type string
+	 */
+	entityId: string;
 	/**
 	 * @type boolean
 	 */
@@ -1870,17 +1881,21 @@ export interface AuthtypesSamlConfigDTO {
 	/**
 	 * @type string
 	 */
-	samlCert?: string;
-	/**
-	 * @type string
-	 */
-	samlEntity?: string;
-	/**
-	 * @type string
-	 */
-	samlIdp?: string;
+	location: string;
 }
 
+export interface AuthtypesAuthDomainConfigSAMLDTO {
+	/**
+	 * @type string
+	 * @enum saml
+	 */
+	kind: AuthtypesAuthDomainConfigSAMLDTOKind;
+	spec: AuthtypesSamlConfigDTO;
+}
+
+export enum AuthtypesAuthDomainConfigGoogleDTOKind {
+	google = 'google',
+}
 export type AuthtypesGoogleConfigDTODomainToAdminEmail = {
 	[key: string]: string;
 };
@@ -1893,11 +1908,11 @@ export interface AuthtypesGoogleConfigDTO {
 	/**
 	 * @type string
 	 */
-	clientId?: string;
+	clientId: string;
 	/**
 	 * @type string
 	 */
-	clientSecret?: string;
+	clientSecret: string;
 	/**
 	 * @type object
 	 */
@@ -1924,16 +1939,28 @@ export interface AuthtypesGoogleConfigDTO {
 	serviceAccountJson?: string;
 }
 
+export interface AuthtypesAuthDomainConfigGoogleDTO {
+	/**
+	 * @type string
+	 * @enum google
+	 */
+	kind: AuthtypesAuthDomainConfigGoogleDTOKind;
+	spec: AuthtypesGoogleConfigDTO;
+}
+
+export enum AuthtypesAuthDomainConfigOIDCDTOKind {
+	oidc = 'oidc',
+}
 export interface AuthtypesOIDCConfigDTO {
 	claimMapping?: AuthtypesAttributeMappingDTO;
 	/**
 	 * @type string
 	 */
-	clientId?: string;
+	clientId: string;
 	/**
 	 * @type string
 	 */
-	clientSecret?: string;
+	clientSecret: string;
 	/**
 	 * @type boolean
 	 */
@@ -1945,79 +1972,33 @@ export interface AuthtypesOIDCConfigDTO {
 	/**
 	 * @type string
 	 */
-	issuer?: string;
+	issuer: string;
 	/**
 	 * @type string
 	 */
 	issuerAlias?: string;
 }
 
-export type AuthtypesRoleMappingDTOGroupMappingsAnyOf = {
-	[key: string]: string;
-};
-
-/**
- * @nullable
- */
-export type AuthtypesRoleMappingDTOGroupMappings =
-	AuthtypesRoleMappingDTOGroupMappingsAnyOf | null;
-
-export interface AuthtypesRoleMappingDTO {
+export interface AuthtypesAuthDomainConfigOIDCDTO {
 	/**
 	 * @type string
+	 * @enum oidc
 	 */
-	defaultRole?: string;
-	/**
-	 * @type object,null
-	 */
-	groupMappings?: AuthtypesRoleMappingDTOGroupMappings;
-	/**
-	 * @type boolean
-	 */
-	useRoleAttribute?: boolean;
+	kind: AuthtypesAuthDomainConfigOIDCDTOKind;
+	spec: AuthtypesOIDCConfigDTO;
 }
 
+export type AuthtypesAuthDomainConfigDTO =
+	| AuthtypesAuthDomainConfigSAMLDTO
+	| AuthtypesAuthDomainConfigGoogleDTO
+	| AuthtypesAuthDomainConfigOIDCDTO;
+
 export enum AuthtypesAuthNProviderDTO {
-	google_auth = 'google_auth',
+	google = 'google',
 	saml = 'saml',
 	email_password = 'email_password',
 	oidc = 'oidc',
 }
-export type AuthtypesAuthDomainConfigDTO =
-	| (AuthtypesSamlConfigDTO & {
-			googleAuthConfig?: AuthtypesGoogleConfigDTO;
-			oidcConfig?: AuthtypesOIDCConfigDTO;
-			roleMapping?: AuthtypesRoleMappingDTO;
-			samlConfig?: AuthtypesSamlConfigDTO;
-			/**
-			 * @type boolean
-			 */
-			ssoEnabled?: boolean;
-			ssoType?: AuthtypesAuthNProviderDTO;
-	  })
-	| (AuthtypesGoogleConfigDTO & {
-			googleAuthConfig?: AuthtypesGoogleConfigDTO;
-			oidcConfig?: AuthtypesOIDCConfigDTO;
-			roleMapping?: AuthtypesRoleMappingDTO;
-			samlConfig?: AuthtypesSamlConfigDTO;
-			/**
-			 * @type boolean
-			 */
-			ssoEnabled?: boolean;
-			ssoType?: AuthtypesAuthNProviderDTO;
-	  })
-	| (AuthtypesOIDCConfigDTO & {
-			googleAuthConfig?: AuthtypesGoogleConfigDTO;
-			oidcConfig?: AuthtypesOIDCConfigDTO;
-			roleMapping?: AuthtypesRoleMappingDTO;
-			samlConfig?: AuthtypesSamlConfigDTO;
-			/**
-			 * @type boolean
-			 */
-			ssoEnabled?: boolean;
-			ssoType?: AuthtypesAuthNProviderDTO;
-	  });
-
 export interface AuthtypesAuthNProviderInfoDTO {
 	/**
 	 * @type string,null
@@ -2055,6 +2036,31 @@ export interface AuthtypesDeprecatedPostableUserRoleDTO {
 	id: string;
 }
 
+export type AuthtypesRoleMappingDTOGroupMappingsAnyOf = {
+	[key: string]: string;
+};
+
+/**
+ * @nullable
+ */
+export type AuthtypesRoleMappingDTOGroupMappings =
+	AuthtypesRoleMappingDTOGroupMappingsAnyOf | null;
+
+export interface AuthtypesRoleMappingDTO {
+	/**
+	 * @type string
+	 */
+	defaultRole?: string;
+	/**
+	 * @type object,null
+	 */
+	groupMappings?: AuthtypesRoleMappingDTOGroupMappings;
+	/**
+	 * @type boolean
+	 */
+	useRoleAttribute?: boolean;
+}
+
 export interface AuthtypesGettableAuthDomainDTO {
 	authNProviderInfo?: AuthtypesAuthNProviderInfoDTO;
 	config?: AuthtypesAuthDomainConfigDTO;
@@ -2063,6 +2069,10 @@ export interface AuthtypesGettableAuthDomainDTO {
 	 * @format date-time
 	 */
 	createdAt?: string;
+	/**
+	 * @type boolean
+	 */
+	enabled?: boolean;
 	/**
 	 * @type string
 	 */
@@ -2075,6 +2085,7 @@ export interface AuthtypesGettableAuthDomainDTO {
 	 * @type string
 	 */
 	orgId?: string;
+	roleMapping?: AuthtypesRoleMappingDTO;
 	/**
 	 * @type string
 	 * @format date-time
@@ -2271,11 +2282,16 @@ export interface AuthtypesOrgSessionContextDTO {
 }
 
 export interface AuthtypesPostableAuthDomainDTO {
-	config?: AuthtypesAuthDomainConfigDTO;
+	config: AuthtypesAuthDomainConfigDTO;
+	/**
+	 * @type boolean
+	 */
+	enabled?: boolean;
 	/**
 	 * @type string
 	 */
-	name?: string;
+	name: string;
+	roleMapping?: AuthtypesRoleMappingDTO;
 }
 
 export interface AuthtypesPostableEmailPasswordSessionDTO {
@@ -2408,7 +2424,12 @@ export interface AuthtypesTransactionDTO {
 }
 
 export interface AuthtypesUpdatableAuthDomainDTO {
-	config?: AuthtypesAuthDomainConfigDTO;
+	config: AuthtypesAuthDomainConfigDTO;
+	/**
+	 * @type boolean
+	 */
+	enabled?: boolean;
+	roleMapping?: AuthtypesRoleMappingDTO;
 }
 
 export interface AuthtypesUpdatableRoleDTO {
@@ -5648,47 +5669,6 @@ export interface InframonitoringtypesChecksDTO {
 	type: InframonitoringtypesCheckTypeDTO;
 }
 
-export enum InframonitoringtypesNodeConditionDTO {
-	ready = 'ready',
-	not_ready = 'not_ready',
-	no_data = 'no_data',
-}
-export enum InframonitoringtypesPodStatusDTO {
-	pending = 'pending',
-	running = 'running',
-	failed = 'failed',
-	unknown = 'unknown',
-	crashloopbackoff = 'crashloopbackoff',
-	imagepullbackoff = 'imagepullbackoff',
-	errimagepull = 'errimagepull',
-	createcontainerconfigerror = 'createcontainerconfigerror',
-	containercreating = 'containercreating',
-	oomkilled = 'oomkilled',
-	completed = 'completed',
-	error = 'error',
-	containercannotrun = 'containercannotrun',
-	evicted = 'evicted',
-	nodeaffinity = 'nodeaffinity',
-	nodelost = 'nodelost',
-	shutdown = 'shutdown',
-	unexpectedadmissionerror = 'unexpectedadmissionerror',
-	no_data = 'no_data',
-}
-export interface InframonitoringtypesClusterFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByNodeReadiness?: InframonitoringtypesNodeConditionDTO[] | null;
-	/**
-	 * @type array,null
-	 */
-	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
-}
-
 export type InframonitoringtypesClusterRecordDTOCounts = {
 	/**
 	 * @type integer
@@ -5964,6 +5944,21 @@ export interface InframonitoringtypesContainerCountsByStatusDTO {
 	waiting: number;
 }
 
+export enum InframonitoringtypesContainerReadyDTO {
+	ready = 'ready',
+	not_ready = 'not_ready',
+	no_data = 'no_data',
+}
+export type InframonitoringtypesContainerRecordDTOMetaAnyOf = {
+	[key: string]: string;
+};
+
+/**
+ * @nullable
+ */
+export type InframonitoringtypesContainerRecordDTOMeta =
+	InframonitoringtypesContainerRecordDTOMetaAnyOf | null;
+
 export enum InframonitoringtypesContainerStatusDTO {
 	running = 'running',
 	waiting = 'waiting',
@@ -5980,32 +5975,6 @@ export enum InframonitoringtypesContainerStatusDTO {
 	unknown = 'unknown',
 	no_data = 'no_data',
 }
-export interface InframonitoringtypesContainerFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByContainerStatus?: InframonitoringtypesContainerStatusDTO[] | null;
-}
-
-export enum InframonitoringtypesContainerReadyDTO {
-	ready = 'ready',
-	not_ready = 'not_ready',
-	no_data = 'no_data',
-}
-export type InframonitoringtypesContainerRecordDTOMetaAnyOf = {
-	[key: string]: string;
-};
-
-/**
- * @nullable
- */
-export type InframonitoringtypesContainerRecordDTOMeta =
-	InframonitoringtypesContainerRecordDTOMetaAnyOf | null;
-
 export interface InframonitoringtypesContainerRecordDTO {
 	containerCountsByReady: InframonitoringtypesContainerCountsByReadyDTO;
 	containerCountsByStatus: InframonitoringtypesContainerCountsByStatusDTO;
@@ -6077,17 +6046,6 @@ export interface InframonitoringtypesContainersDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
-export interface InframonitoringtypesDaemonSetFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
-}
-
 export type InframonitoringtypesDaemonSetRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6173,17 +6131,6 @@ export interface InframonitoringtypesDaemonSetsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
-export interface InframonitoringtypesDeploymentFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
-}
-
 export type InframonitoringtypesDeploymentRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6346,17 +6293,6 @@ export interface InframonitoringtypesHostsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
-export interface InframonitoringtypesJobFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
-}
-
 export type InframonitoringtypesJobRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6442,17 +6378,6 @@ export interface InframonitoringtypesJobsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
-export interface InframonitoringtypesNamespaceFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
-}
-
 export type InframonitoringtypesNamespaceRecordDTOCounts = {
 	/**
 	 * @type integer
@@ -6529,21 +6454,11 @@ export interface InframonitoringtypesNamespacesDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
-export interface InframonitoringtypesNodeFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByNodeReadiness?: InframonitoringtypesNodeConditionDTO[] | null;
-	/**
-	 * @type array,null
-	 */
-	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+export enum InframonitoringtypesNodeConditionDTO {
+	ready = 'ready',
+	not_ready = 'not_ready',
+	no_data = 'no_data',
 }
-
 export type InframonitoringtypesNodeRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6605,17 +6520,6 @@ export interface InframonitoringtypesNodesDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
-export interface InframonitoringtypesPodFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
-}
-
 export type InframonitoringtypesPodRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6626,6 +6530,27 @@ export type InframonitoringtypesPodRecordDTOMetaAnyOf = {
 export type InframonitoringtypesPodRecordDTOMeta =
 	InframonitoringtypesPodRecordDTOMetaAnyOf | null;
 
+export enum InframonitoringtypesPodStatusDTO {
+	pending = 'pending',
+	running = 'running',
+	failed = 'failed',
+	unknown = 'unknown',
+	crashloopbackoff = 'crashloopbackoff',
+	imagepullbackoff = 'imagepullbackoff',
+	errimagepull = 'errimagepull',
+	createcontainerconfigerror = 'createcontainerconfigerror',
+	containercreating = 'containercreating',
+	oomkilled = 'oomkilled',
+	completed = 'completed',
+	error = 'error',
+	containercannotrun = 'containercannotrun',
+	evicted = 'evicted',
+	nodeaffinity = 'nodeaffinity',
+	nodelost = 'nodelost',
+	shutdown = 'shutdown',
+	unexpectedadmissionerror = 'unexpectedadmissionerror',
+	no_data = 'no_data',
+}
 export interface InframonitoringtypesPodRecordDTO {
 	/**
 	 * @type object,null
@@ -6702,7 +6627,7 @@ export interface InframonitoringtypesPostableClustersDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesClusterFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6729,7 +6654,7 @@ export interface InframonitoringtypesPostableContainersDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesContainerFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6756,7 +6681,7 @@ export interface InframonitoringtypesPostableDaemonSetsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesDaemonSetFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6783,7 +6708,7 @@ export interface InframonitoringtypesPostableDeploymentsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesDeploymentFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6837,7 +6762,7 @@ export interface InframonitoringtypesPostableJobsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesJobFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6864,7 +6789,7 @@ export interface InframonitoringtypesPostableNamespacesDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesNamespaceFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6891,7 +6816,7 @@ export interface InframonitoringtypesPostableNodesDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesNodeFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6918,7 +6843,7 @@ export interface InframonitoringtypesPostablePodsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesPodFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6939,24 +6864,13 @@ export interface InframonitoringtypesPostablePodsDTO {
 	start: number;
 }
 
-export interface InframonitoringtypesStatefulSetFilterDTO {
-	/**
-	 * @type string
-	 */
-	expression?: string;
-	/**
-	 * @type array,null
-	 */
-	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
-}
-
 export interface InframonitoringtypesPostableStatefulSetsDTO {
 	/**
 	 * @type integer
 	 * @format int64
 	 */
 	end: number;
-	filter?: InframonitoringtypesStatefulSetFilterDTO;
+	filter?: Querybuildertypesv5FilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -10532,42 +10446,6 @@ export type CreatePublicDashboard201 = {
 export type UpdatePublicDashboardPathParameters = {
 	id: string;
 };
-export type ListAuthDomains200 = {
-	/**
-	 * @type array
-	 */
-	data: AuthtypesGettableAuthDomainDTO[];
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type CreateAuthDomain201 = {
-	data: TypesIdentifiableDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type DeleteAuthDomainPathParameters = {
-	id: string;
-};
-export type GetAuthDomainPathParameters = {
-	id: string;
-};
-export type GetAuthDomain200 = {
-	data: AuthtypesGettableAuthDomainDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type UpdateAuthDomainPathParameters = {
-	id: string;
-};
 export type ListDowntimeSchedulesParams = {
 	/**
 	 * @type boolean,null
@@ -11266,6 +11144,42 @@ export type GetUserPreference200 = {
 export type UpdateUserPreferencePathParameters = {
 	name: string;
 };
+export type ListAuthDomains200 = {
+	/**
+	 * @type array
+	 */
+	data: AuthtypesGettableAuthDomainDTO[];
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type CreateAuthDomain201 = {
+	data: TypesIdentifiableDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type DeleteAuthDomainPathParameters = {
+	id: string;
+};
+export type GetAuthDomainPathParameters = {
+	id: string;
+};
+export type GetAuthDomain200 = {
+	data: AuthtypesGettableAuthDomainDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type UpdateAuthDomainPathParameters = {
+	id: string;
+};
 export type ListDashboardViews200 = {
 	data: DashboardtypesListableDashboardViewDTO;
 	/**

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/AuthnProviderSelector.tsx

@@ -16,7 +16,7 @@ interface AuthNProvider {
 function getAuthNProviders(samlEnabled: boolean): AuthNProvider[] {
 	return [
 		{
-			key: AuthtypesAuthNProviderDTO.google_auth,
+			key: AuthtypesAuthNProviderDTO.google,
 			title: 'Google Apps Authentication',
 			description: 'Let members sign-in with a Google workspace account',
 			icon: <SolidGoogle size={37} />,

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.tsx

@@ -8,6 +8,10 @@ import {
 	useUpdateAuthDomain,
 } from 'api/generated/services/authdomains';
 import {
+	AuthtypesAuthDomainConfigDTO,
+	AuthtypesAuthDomainConfigGoogleDTOKind,
+	AuthtypesAuthDomainConfigOIDCDTOKind,
+	AuthtypesAuthDomainConfigSAMLDTOKind,
 	AuthtypesAuthNProviderDTO,
 	AuthtypesGettableAuthDomainDTO,
 	AuthtypesGoogleConfigDTO,
@@ -41,7 +45,7 @@ function configureAuthnProvider(
 	switch (authnProvider) {
 		case 'saml':
 			return <ConfigureSAMLAuthnProvider isCreate={isCreate} />;
-		case 'google_auth':
+		case 'google':
 			return <ConfigureGoogleAuthAuthnProvider isCreate={isCreate} />;
 		case 'oidc':
 			return <ConfigureOIDCAuthnProvider isCreate={isCreate} />;
@@ -61,7 +65,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 	const [form] = Form.useForm<FormValues>();
 	const [authnProvider, setAuthnProvider] = useState<
 		AuthtypesAuthNProviderDTO | ''
-	>(record?.config?.ssoType || '');
+	>((record?.config?.kind as unknown as AuthtypesAuthNProviderDTO) ?? '');
 
 	const { showErrorModal } = useErrorModal();
 	const { featureFlags } = useAppContext();
@@ -147,6 +151,33 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 		};
 	}, [form]);
 
+	// Prepares the kind/spec config envelope for API payload
+	const getConfig = useCallback((): AuthtypesAuthDomainConfigDTO | undefined => {
+		switch (authnProvider) {
+			case AuthtypesAuthNProviderDTO.saml:
+				return {
+					kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+					spec: form.getFieldValue('samlConfig'),
+				};
+			case AuthtypesAuthNProviderDTO.google: {
+				const spec = getGoogleAuthConfig();
+				return spec
+					? {
+							kind: AuthtypesAuthDomainConfigGoogleDTOKind.google,
+							spec,
+						}
+					: undefined;
+			}
+			case AuthtypesAuthNProviderDTO.oidc:
+				return {
+					kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+					spec: form.getFieldValue('oidcConfig'),
+				};
+			default:
+				return undefined;
+		}
+	}, [authnProvider, form, getGoogleAuthConfig]);
+
 	const onSubmitHandler = useCallback(async (): Promise<void> => {
 		try {
 			await form.validateFields();
@@ -159,24 +190,21 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 		}
 
 		const name = form.getFieldValue('name');
-		const googleAuthConfig = getGoogleAuthConfig();
-		const samlConfig = form.getFieldValue('samlConfig');
-		const oidcConfig = form.getFieldValue('oidcConfig');
+		const config = getConfig();
 		const roleMapping = getRoleMapping();
 
+		if (!config) {
+			return;
+		}
+
 		if (isCreate) {
 			createAuthDomain(
 				{
 					data: {
 						name,
-						config: {
-							ssoEnabled: true,
-							ssoType: authnProvider,
-							googleAuthConfig,
-							samlConfig,
-							oidcConfig,
-							roleMapping,
-						},
+						enabled: true,
+						config,
+						roleMapping,
 					},
 				},
 				{
@@ -196,14 +224,9 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 				{
 					pathParams: { id: record.id },
 					data: {
-						config: {
-							ssoEnabled: form.getFieldValue('ssoEnabled'),
-							ssoType: authnProvider,
-							googleAuthConfig,
-							samlConfig,
-							oidcConfig,
-							roleMapping,
-						},
+						enabled: form.getFieldValue('enabled'),
+						config,
+						roleMapping,
 					},
 				},
 				{
@@ -219,7 +242,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 		authnProvider,
 		createAuthDomain,
 		form,
-		getGoogleAuthConfig,
+		getConfig,
 		getRoleMapping,
 		handleError,
 		isCreate,
@@ -245,8 +268,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 				name="auth-domain"
 				initialValues={defaultTo(prepareInitialValues(record), {
 					name: '',
-					ssoEnabled: false,
-					ssoType: '',
+					enabled: false,
 				})}
 				form={form}
 				layout="vertical"

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.utils.test.ts

@@ -1,4 +1,8 @@
-import { AuthtypesAuthNProviderDTO } from 'api/generated/services/sigNoz.schemas';
+import {
+	AuthtypesAuthDomainConfigGoogleDTOKind,
+	AuthtypesAuthDomainConfigOIDCDTOKind,
+	AuthtypesAuthDomainConfigSAMLDTOKind,
+} from 'api/generated/services/sigNoz.schemas';
 
 import {
 	convertDomainMappingsToList,
@@ -82,8 +86,7 @@ describe('prepareInitialValues', () => {
 	it('returns empty defaults when no record is provided', () => {
 		expect(prepareInitialValues(undefined)).toStrictEqual({
 			name: '',
-			ssoEnabled: false,
-			ssoType: '',
+			enabled: false,
 		});
 	});
 
@@ -91,15 +94,20 @@ describe('prepareInitialValues', () => {
 		const result = prepareInitialValues({
 			id: 'domain-1',
 			name: 'example.com',
+			enabled: true,
 			config: {
-				ssoEnabled: true,
-				ssoType: AuthtypesAuthNProviderDTO.saml,
-				roleMapping: {
-					defaultRole: 'VIEWER',
-					useRoleAttribute: false,
-					groupMappings: { admins: 'ADMIN', viewers: 'VIEWER' },
+				kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+				spec: {
+					location: 'https://idp.example.com/sso',
+					entityId: 'urn:example:idp',
+					certificate: 'CERT',
 				},
 			},
+			roleMapping: {
+				defaultRole: 'VIEWER',
+				useRoleAttribute: false,
+				groupMappings: { admins: 'ADMIN', viewers: 'VIEWER' },
+			},
 		});
 
 		expect(result.roleMapping?.groupMappingsList).toStrictEqual([
@@ -112,10 +120,10 @@ describe('prepareInitialValues', () => {
 		const result = prepareInitialValues({
 			id: 'domain-1',
 			name: 'example.com',
+			enabled: true,
 			config: {
-				ssoEnabled: true,
-				ssoType: AuthtypesAuthNProviderDTO.google_auth,
-				googleAuthConfig: {
+				kind: AuthtypesAuthDomainConfigGoogleDTOKind.google,
+				spec: {
 					clientId: 'id',
 					clientSecret: 'secret',
 					domainToAdminEmail: { 'example.com': 'admin@example.com' },
@@ -132,11 +140,16 @@ describe('prepareInitialValues', () => {
 		const result = prepareInitialValues({
 			id: 'domain-1',
 			name: 'example.com',
+			enabled: true,
 			config: {
-				ssoEnabled: true,
-				ssoType: AuthtypesAuthNProviderDTO.oidc,
-				roleMapping: { defaultRole: 'VIEWER', useRoleAttribute: true },
+				kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+				spec: {
+					issuer: 'https://oidc.example.com',
+					clientId: 'id',
+					clientSecret: 'secret',
+				},
 			},
+			roleMapping: { defaultRole: 'VIEWER', useRoleAttribute: true },
 		});
 
 		expect(result.roleMapping?.groupMappingsList).toStrictEqual([]);

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.utils.ts

@@ -1,4 +1,7 @@
 import {
+	AuthtypesAuthDomainConfigGoogleDTOKind,
+	AuthtypesAuthDomainConfigOIDCDTOKind,
+	AuthtypesAuthDomainConfigSAMLDTOKind,
 	AuthtypesGettableAuthDomainDTO,
 	AuthtypesGoogleConfigDTO,
 	AuthtypesOIDCConfigDTO,
@@ -9,8 +12,7 @@ import {
 // Form values interface for internal use (includes array-based fields for UI)
 export interface FormValues {
 	name?: string;
-	ssoEnabled?: boolean;
-	ssoType?: string;
+	enabled?: boolean;
 	googleAuthConfig?: AuthtypesGoogleConfigDTO & {
 		domainToAdminEmailList?: Array<{ domain?: string; adminEmail?: string }>;
 	};
@@ -107,31 +109,36 @@ export function prepareInitialValues(
 	if (!record) {
 		return {
 			name: '',
-			ssoEnabled: false,
-			ssoType: '',
+			enabled: false,
 		};
 	}
 
-	const config = record.config ?? {};
+	const { config } = record;
 	return {
 		name: record.name,
-		ssoEnabled: config.ssoEnabled,
-		ssoType: config.ssoType,
-		samlConfig: config.samlConfig ?? undefined,
-		oidcConfig: config.oidcConfig ?? undefined,
-		googleAuthConfig: config.googleAuthConfig
+		enabled: record.enabled,
+		samlConfig:
+			config?.kind === AuthtypesAuthDomainConfigSAMLDTOKind.saml
+				? config.spec
+				: undefined,
+		oidcConfig:
+			config?.kind === AuthtypesAuthDomainConfigOIDCDTOKind.oidc
+				? config.spec
+				: undefined,
+		googleAuthConfig:
+			config?.kind === AuthtypesAuthDomainConfigGoogleDTOKind.google
+				? {
+						...config.spec,
+						domainToAdminEmailList: convertDomainMappingsToList(
+							config.spec.domainToAdminEmail,
+						),
+					}
+				: undefined,
+		roleMapping: record.roleMapping
 			? {
-					...config.googleAuthConfig,
-					domainToAdminEmailList: convertDomainMappingsToList(
-						config.googleAuthConfig.domainToAdminEmail,
-					),
-				}
-			: undefined,
-		roleMapping: config.roleMapping
-			? {
-					...config.roleMapping,
+					...record.roleMapping,
 					groupMappingsList: convertGroupMappingsToList(
-						config.roleMapping.groupMappings,
+						record.roleMapping.groupMappings,
 					),
 				}
 			: undefined,

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/Providers/AuthnSAML.tsx

@@ -76,7 +76,7 @@ function ConfigureSAMLAuthnProvider({
 							</Tooltip>
 						</label>
 						<Form.Item
-							name={['samlConfig', 'samlIdp']}
+							name={['samlConfig', 'location']}
 							className="authn-provider__form-item"
 							rules={[
 								{
@@ -98,7 +98,7 @@ function ConfigureSAMLAuthnProvider({
 							</Tooltip>
 						</label>
 						<Form.Item
-							name={['samlConfig', 'samlEntity']}
+							name={['samlConfig', 'entityId']}
 							className="authn-provider__form-item"
 							rules={[
 								{
@@ -120,7 +120,7 @@ function ConfigureSAMLAuthnProvider({
 							</Tooltip>
 						</label>
 						<Form.Item
-							name={['samlConfig', 'samlCert']}
+							name={['samlConfig', 'certificate']}
 							className="authn-provider__form-item"
 							rules={[
 								{

frontend/src/container/OrganizationSettings/AuthDomain/SSOEnforcementToggle.tsx

@@ -31,7 +31,7 @@ function SSOEnforcementToggle({
 		useUpdateAuthDomain<AxiosError<RenderErrorResponseDTO>>();
 
 	const onChangeHandler = (checked: boolean): void => {
-		if (!record.id) {
+		if (!record.id || !record.config) {
 			return;
 		}
 
@@ -41,14 +41,9 @@ function SSOEnforcementToggle({
 			{
 				pathParams: { id: record.id },
 				data: {
-					config: {
-						ssoEnabled: checked,
-						ssoType: record.config?.ssoType,
-						googleAuthConfig: record.config?.googleAuthConfig,
-						oidcConfig: record.config?.oidcConfig,
-						samlConfig: record.config?.samlConfig,
-						roleMapping: record.config?.roleMapping,
-					},
+					enabled: checked,
+					config: record.config,
+					roleMapping: record.roleMapping,
 				},
 			},
 			{

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/AuthDomain.test.tsx

@@ -58,7 +58,7 @@ describe('AuthDomain', () => {
 			});
 		});
 
-		it('reflects ssoEnabled state from nested config in each row toggle', async () => {
+		it('reflects the enabled state in each row toggle', async () => {
 			server.use(
 				rest.get(AUTH_DOMAINS_LIST_ENDPOINT, (_, res, ctx) =>
 					res(ctx.status(200), ctx.json(mockDomainsListResponse)),
@@ -68,9 +68,9 @@ describe('AuthDomain', () => {
 			render(<AuthDomain />);
 
 			// mockDomainsListResponse rows:
-			//   [0] signoz.io   → config.ssoEnabled: true
-			//   [1] example.com → config.ssoEnabled: false
-			//   [2] corp.io     → config.ssoEnabled: true
+			//   [0] signoz.io   → enabled: true
+			//   [1] example.com → enabled: false
+			//   [2] corp.io     → enabled: true
 			const switches = await screen.findAllByRole('switch');
 			expect(switches).toHaveLength(3);
 			expect(switches[0]).toBeChecked();

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.payload.test.tsx

@@ -112,9 +112,7 @@ describe('CreateEdit — save payload correctness', () => {
 		await waitFor(() => expect(capturedPayload).not.toBeNull());
 
 		expect(capturedPayload).toMatchObject({
-			config: expect.objectContaining({
-				roleMapping: expect.objectContaining({ groupMappings: {} }),
-			}),
+			roleMapping: expect.objectContaining({ groupMappings: {} }),
 		});
 	});
 
@@ -161,7 +159,7 @@ describe('CreateEdit — save payload correctness', () => {
 
 		expect(capturedPayload).toMatchObject({
 			config: expect.objectContaining({
-				googleAuthConfig: expect.objectContaining({
+				spec: expect.objectContaining({
 					domainToAdminEmail: {},
 				}),
 			}),

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.roleMapping.test.tsx

@@ -188,8 +188,8 @@ describe('CreateEdit — role mapping uses API roles', () => {
 
 		// SSO role mapping matches roles by name, so the payload carries the
 		// role *name*, not the opaque id.
-		expect(payload.get().config.roleMapping.defaultRole).toBe(editorRole.name);
-		expect(payload.get().config.roleMapping.defaultRole).not.toBe(editorRole.id);
+		expect(payload.get().roleMapping.defaultRole).toBe(editorRole.name);
+		expect(payload.get().roleMapping.defaultRole).not.toBe(editorRole.id);
 	});
 
 	it('defaults a fresh role mapping to the signoz-viewer role name', async () => {
@@ -221,8 +221,8 @@ describe('CreateEdit — role mapping uses API roles', () => {
 
 		await waitFor(() => expect(payload.get()).not.toBeNull());
 
-		expect(payload.get().config.roleMapping.defaultRole).toBe(viewerRole.name);
-		expect(payload.get().config.roleMapping.defaultRole).not.toBe(viewerRole.id);
+		expect(payload.get().roleMapping.defaultRole).toBe(viewerRole.name);
+		expect(payload.get().roleMapping.defaultRole).not.toBe(viewerRole.id);
 	});
 
 	it('still defaults to signoz-viewer when the roles fetch returns empty', async () => {
@@ -249,7 +249,7 @@ describe('CreateEdit — role mapping uses API roles', () => {
 		await waitFor(() => expect(payload.get()).not.toBeNull());
 
 		// The Form.Item initialValue (signoz-viewer) survives an empty roles list.
-		expect(payload.get().config.roleMapping.defaultRole).toBe(viewerRole.name);
+		expect(payload.get().roleMapping.defaultRole).toBe(viewerRole.name);
 	});
 
 	it('loads a stored role mapping by role name and round-trips it on save', async () => {
@@ -280,8 +280,8 @@ describe('CreateEdit — role mapping uses API roles', () => {
 
 		await waitFor(() => expect(payload.get()).not.toBeNull());
 
-		expect(payload.get().config.roleMapping.defaultRole).toBe(editorRole.name);
-		expect(payload.get().config.roleMapping.groupMappings).toStrictEqual({
+		expect(payload.get().roleMapping.defaultRole).toBe(editorRole.name);
+		expect(payload.get().roleMapping.groupMappings).toStrictEqual({
 			'admin-group': 'signoz-admin',
 			'dev-team': 'signoz-editor',
 			viewers: 'signoz-viewer',

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.sanitization.test.tsx

@@ -1,6 +1,9 @@
 import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
 import { rest, server } from 'mocks-server/server';
-import { AuthtypesGettableAuthDomainDTO } from 'api/generated/services/sigNoz.schemas';
+import {
+	AuthtypesAuthDomainConfigGoogleDTO,
+	AuthtypesGettableAuthDomainDTO,
+} from 'api/generated/services/sigNoz.schemas';
 
 import CreateEdit from '../CreateEdit/CreateEdit';
 import {
@@ -48,11 +51,10 @@ jest.mock('@signozhq/ui/button', () => ({
 
 type SavedPayload = {
 	config: {
-		googleAuthConfig?: Record<string, unknown>;
-		samlConfig?: Record<string, unknown>;
-		oidcConfig?: Record<string, unknown>;
-		roleMapping?: Record<string, unknown>;
+		kind?: string;
+		spec?: Record<string, unknown>;
 	};
+	roleMapping?: Record<string, unknown>;
 };
 
 async function submitForm(
@@ -81,7 +83,7 @@ describe('CreateEdit — payload sanitization', () => {
 		it('sends core fields and omits workspace fields when fetchGroups is not set', async () => {
 			const payload = await submitForm(mockGoogleAuthDomain);
 
-			const g = payload.config.googleAuthConfig;
+			const g = payload.config.spec;
 			expect(g?.clientId).toBe('test-client-id');
 			expect(g?.clientSecret).toBe('test-client-secret');
 			expect(g?.allowedGroups).toBeUndefined();
@@ -91,18 +93,20 @@ describe('CreateEdit — payload sanitization', () => {
 		});
 
 		it('strips workspace fields when fetchGroups is false', async () => {
+			const googleConfig =
+				mockGoogleAuthWithWorkspaceGroups.config as AuthtypesAuthDomainConfigGoogleDTO;
 			const payload = await submitForm({
 				...mockGoogleAuthWithWorkspaceGroups,
 				config: {
-					...mockGoogleAuthWithWorkspaceGroups.config,
-					googleAuthConfig: {
-						...mockGoogleAuthWithWorkspaceGroups.config?.googleAuthConfig,
+					...googleConfig,
+					spec: {
+						...googleConfig.spec,
 						fetchGroups: false,
 					},
 				},
 			});
 
-			const g = payload.config.googleAuthConfig;
+			const g = payload.config.spec;
 			expect(g?.fetchGroups).toBe(false);
 			expect(g?.allowedGroups).toBeUndefined();
 			expect(g?.serviceAccountJson).toBeUndefined();
@@ -113,7 +117,7 @@ describe('CreateEdit — payload sanitization', () => {
 		it('includes all workspace fields when fetchGroups is true', async () => {
 			const payload = await submitForm(mockGoogleAuthWithWorkspaceGroups);
 
-			const g = payload.config.googleAuthConfig;
+			const g = payload.config.spec;
 			expect(g?.fetchGroups).toBe(true);
 			expect(g?.serviceAccountJson).toBe('{"type": "service_account"}');
 			expect(g?.fetchTransitiveGroupMembership).toBe(true);
@@ -131,10 +135,10 @@ describe('CreateEdit — payload sanitization', () => {
 		it('sends core and attributeMapping fields', async () => {
 			const payload = await submitForm(mockSamlWithAttributeMapping);
 
-			const s = payload.config.samlConfig;
-			expect(s?.samlIdp).toBe('https://idp.saml-attrs.com/sso');
-			expect(s?.samlEntity).toBe('urn:saml-attrs:idp');
-			expect(s?.samlCert).toBe('MOCK_CERTIFICATE_ATTRS');
+			const s = payload.config.spec;
+			expect(s?.location).toBe('https://idp.saml-attrs.com/sso');
+			expect(s?.entityId).toBe('urn:saml-attrs:idp');
+			expect(s?.certificate).toBe('MOCK_CERTIFICATE_ATTRS');
 			expect(s?.insecureSkipAuthNRequestsSigned).toBe(true);
 
 			const attr = s?.attributeMapping as Record<string, unknown>;
@@ -148,7 +152,7 @@ describe('CreateEdit — payload sanitization', () => {
 		it('sends all fields including claimMapping', async () => {
 			const payload = await submitForm(mockOidcWithClaimMapping);
 
-			const o = payload.config.oidcConfig;
+			const o = payload.config.spec;
 			expect(o?.issuer).toBe('https://oidc.claims.com');
 			expect(o?.issuerAlias).toBe('https://alias.claims.com');
 			expect(o?.clientId).toBe('claims-client-id');
@@ -168,24 +172,21 @@ describe('CreateEdit — payload sanitization', () => {
 		it('strips groupMappings when useRoleAttribute is true', async () => {
 			const payload = await submitForm({
 				...mockDomainWithRoleMapping,
-				config: {
-					...mockDomainWithRoleMapping.config,
-					roleMapping: {
-						...mockDomainWithRoleMapping.config?.roleMapping,
-						useRoleAttribute: true,
-					},
+				roleMapping: {
+					...mockDomainWithRoleMapping.roleMapping,
+					useRoleAttribute: true,
 				},
 			});
 
-			expect(payload.config.roleMapping?.useRoleAttribute).toBe(true);
-			expect(payload.config.roleMapping?.groupMappings).toBeUndefined();
+			expect(payload.roleMapping?.useRoleAttribute).toBe(true);
+			expect(payload.roleMapping?.groupMappings).toBeUndefined();
 		});
 
 		it('sends groupMappings when useRoleAttribute is false', async () => {
 			const payload = await submitForm(mockDomainWithRoleMapping);
 
-			expect(payload.config.roleMapping?.useRoleAttribute).toBe(false);
-			expect(payload.config.roleMapping?.groupMappings).toStrictEqual({
+			expect(payload.roleMapping?.useRoleAttribute).toBe(false);
+			expect(payload.roleMapping?.groupMappings).toStrictEqual({
 				'admin-group': 'signoz-admin',
 				'dev-team': 'signoz-editor',
 				viewers: 'signoz-viewer',

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/SSOEnforcementToggle.test.tsx

@@ -57,7 +57,7 @@ describe('SSOEnforcementToggle', () => {
 				isDefaultChecked={false}
 				record={{
 					...mockGoogleAuthDomain,
-					config: { ...mockGoogleAuthDomain.config, ssoEnabled: false },
+					enabled: false,
 				}}
 			/>,
 		);
@@ -95,9 +95,7 @@ describe('SSOEnforcementToggle', () => {
 		expect(mockUpdateAPI).toHaveBeenCalledTimes(1);
 		expect(mockUpdateAPI).toHaveBeenCalledWith(
 			expect.objectContaining({
-				config: expect.objectContaining({
-					ssoEnabled: false,
-				}),
+				enabled: false,
 			}),
 		);
 	});

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/mocks.ts

@@ -1,22 +1,24 @@
 import {
-	AuthtypesAuthNProviderDTO,
+	AuthtypesAuthDomainConfigGoogleDTOKind,
+	AuthtypesAuthDomainConfigOIDCDTOKind,
+	AuthtypesAuthDomainConfigSAMLDTOKind,
 	AuthtypesGettableAuthDomainDTO,
 } from 'api/generated/services/sigNoz.schemas';
 
 // API Endpoints
-export const AUTH_DOMAINS_LIST_ENDPOINT = '*/api/v1/domains';
-export const AUTH_DOMAINS_CREATE_ENDPOINT = '*/api/v1/domains';
-export const AUTH_DOMAINS_UPDATE_ENDPOINT = '*/api/v1/domains/:id';
-export const AUTH_DOMAINS_DELETE_ENDPOINT = '*/api/v1/domains/:id';
+export const AUTH_DOMAINS_LIST_ENDPOINT = '*/api/v2/auth_domains';
+export const AUTH_DOMAINS_CREATE_ENDPOINT = '*/api/v2/auth_domains';
+export const AUTH_DOMAINS_UPDATE_ENDPOINT = '*/api/v2/auth_domains/:id';
+export const AUTH_DOMAINS_DELETE_ENDPOINT = '*/api/v2/auth_domains/:id';
 
 // Mock Auth Domain with Google Auth
 export const mockGoogleAuthDomain: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-1',
 	name: 'signoz.io',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.google_auth,
-		googleAuthConfig: {
+		kind: AuthtypesAuthDomainConfigGoogleDTOKind.google,
+		spec: {
 			clientId: 'test-client-id',
 			clientSecret: 'test-client-secret',
 		},
@@ -30,13 +32,13 @@ export const mockGoogleAuthDomain: AuthtypesGettableAuthDomainDTO = {
 export const mockSamlAuthDomain: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-2',
 	name: 'example.com',
+	enabled: false,
 	config: {
-		ssoEnabled: false,
-		ssoType: AuthtypesAuthNProviderDTO.saml,
-		samlConfig: {
-			samlIdp: 'https://idp.example.com/sso',
-			samlEntity: 'urn:example:idp',
-			samlCert: 'MOCK_CERTIFICATE',
+		kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+		spec: {
+			location: 'https://idp.example.com/sso',
+			entityId: 'urn:example:idp',
+			certificate: 'MOCK_CERTIFICATE',
 		},
 	},
 	authNProviderInfo: {
@@ -48,10 +50,10 @@ export const mockSamlAuthDomain: AuthtypesGettableAuthDomainDTO = {
 export const mockOidcAuthDomain: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-3',
 	name: 'corp.io',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.oidc,
-		oidcConfig: {
+		kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+		spec: {
 			issuer: 'https://oidc.corp.io',
 			clientId: 'oidc-client-id',
 			clientSecret: 'oidc-client-secret',
@@ -66,22 +68,22 @@ export const mockOidcAuthDomain: AuthtypesGettableAuthDomainDTO = {
 export const mockDomainWithRoleMapping: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-4',
 	name: 'enterprise.com',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.saml,
-		samlConfig: {
-			samlIdp: 'https://idp.enterprise.com/sso',
-			samlEntity: 'urn:enterprise:idp',
-			samlCert: 'MOCK_CERTIFICATE',
+		kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+		spec: {
+			location: 'https://idp.enterprise.com/sso',
+			entityId: 'urn:enterprise:idp',
+			certificate: 'MOCK_CERTIFICATE',
 		},
-		roleMapping: {
-			defaultRole: 'signoz-editor',
-			useRoleAttribute: false,
-			groupMappings: {
-				'admin-group': 'signoz-admin',
-				'dev-team': 'signoz-editor',
-				viewers: 'signoz-viewer',
-			},
+	},
+	roleMapping: {
+		defaultRole: 'signoz-editor',
+		useRoleAttribute: false,
+		groupMappings: {
+			'admin-group': 'signoz-admin',
+			'dev-team': 'signoz-editor',
+			viewers: 'signoz-viewer',
 		},
 	},
 	authNProviderInfo: {
@@ -94,18 +96,18 @@ export const mockDomainWithDirectRoleAttribute: AuthtypesGettableAuthDomainDTO =
 	{
 		id: 'domain-5',
 		name: 'direct-role.com',
+		enabled: true,
 		config: {
-			ssoEnabled: true,
-			ssoType: AuthtypesAuthNProviderDTO.oidc,
-			oidcConfig: {
+			kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+			spec: {
 				issuer: 'https://oidc.direct-role.com',
 				clientId: 'direct-role-client-id',
 				clientSecret: 'direct-role-client-secret',
 			},
-			roleMapping: {
-				defaultRole: 'signoz-viewer',
-				useRoleAttribute: true,
-			},
+		},
+		roleMapping: {
+			defaultRole: 'signoz-viewer',
+			useRoleAttribute: true,
 		},
 		authNProviderInfo: {
 			relayStatePath: 'api/v1/sso/relay/domain-5',
@@ -116,10 +118,10 @@ export const mockDomainWithDirectRoleAttribute: AuthtypesGettableAuthDomainDTO =
 export const mockOidcWithClaimMapping: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-6',
 	name: 'oidc-claims.com',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.oidc,
-		oidcConfig: {
+		kind: AuthtypesAuthDomainConfigOIDCDTOKind.oidc,
+		spec: {
 			issuer: 'https://oidc.claims.com',
 			issuerAlias: 'https://alias.claims.com',
 			clientId: 'claims-client-id',
@@ -143,13 +145,13 @@ export const mockOidcWithClaimMapping: AuthtypesGettableAuthDomainDTO = {
 export const mockSamlWithAttributeMapping: AuthtypesGettableAuthDomainDTO = {
 	id: 'domain-7',
 	name: 'saml-attrs.com',
+	enabled: true,
 	config: {
-		ssoEnabled: true,
-		ssoType: AuthtypesAuthNProviderDTO.saml,
-		samlConfig: {
-			samlIdp: 'https://idp.saml-attrs.com/sso',
-			samlEntity: 'urn:saml-attrs:idp',
-			samlCert: 'MOCK_CERTIFICATE_ATTRS',
+		kind: AuthtypesAuthDomainConfigSAMLDTOKind.saml,
+		spec: {
+			location: 'https://idp.saml-attrs.com/sso',
+			entityId: 'urn:saml-attrs:idp',
+			certificate: 'MOCK_CERTIFICATE_ATTRS',
 			insecureSkipAuthNRequestsSigned: true,
 			attributeMapping: {
 				name: 'user_display_name',
@@ -168,10 +170,10 @@ export const mockGoogleAuthWithWorkspaceGroups: AuthtypesGettableAuthDomainDTO =
 	{
 		id: 'domain-8',
 		name: 'google-groups.com',
+		enabled: true,
 		config: {
-			ssoEnabled: true,
-			ssoType: AuthtypesAuthNProviderDTO.google_auth,
-			googleAuthConfig: {
+			kind: AuthtypesAuthDomainConfigGoogleDTOKind.google,
+			spec: {
 				clientId: 'google-groups-client-id',
 				clientSecret: 'google-groups-client-secret',
 				insecureSkipEmailVerified: false,
@@ -218,7 +220,7 @@ export const mockUpdateSuccessResponse = {
 	status: 'success',
 	data: {
 		...mockGoogleAuthDomain,
-		config: { ...mockGoogleAuthDomain.config, ssoEnabled: false },
+		enabled: false,
 	},
 };
 

frontend/src/container/OrganizationSettings/AuthDomain/index.tsx

@@ -26,7 +26,7 @@ import './AuthDomain.styles.scss';
 import '../../IngestionSettings/IngestionSettings.styles.scss';
 
 export const SSOType = new Map<string, string>([
-	['google_auth', 'Google Auth'],
+	['google', 'Google Auth'],
 	['saml', 'SAML'],
 	['email_password', 'Email Password'],
 	['oidc', 'OIDC'],
@@ -121,8 +121,8 @@ function AuthDomain(): JSX.Element {
 			},
 			{
 				title: 'Enforce SSO',
-				dataIndex: ['config', 'ssoEnabled'],
-				key: 'ssoEnabled',
+				dataIndex: 'enabled',
+				key: 'enabled',
 				width: 80,
 				render: (
 					value: boolean,
@@ -158,7 +158,7 @@ function AuthDomain(): JSX.Element {
 							onClick={(): void => setRecord(record)}
 							variant="link"
 						>
-							Configure {SSOType.get(record.config?.ssoType || '')}
+							Configure {SSOType.get(record.config?.kind || '')}
 						</Button>
 						<Button
 							className="auth-domain-list-action-link delete"

pkg/apiserver/signozapiserver/authdomain.go

@@ -10,7 +10,7 @@ import (
 )
 
 func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v1/domains", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.List), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.List), handler.OpenAPIDef{
 		ID:                  "ListAuthDomains",
 		Tags:                []string{"authdomains"},
 		Summary:             "List all auth domains",
@@ -27,7 +27,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/domains", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Create), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Create), handler.OpenAPIDef{
 		ID:                  "CreateAuthDomain",
 		Tags:                []string{"authdomains"},
 		Summary:             "Create auth domain",
@@ -44,7 +44,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Get), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Get), handler.OpenAPIDef{
 		ID:                  "GetAuthDomain",
 		Tags:                []string{"authdomains"},
 		Summary:             "Get auth domain by ID",
@@ -61,7 +61,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Update), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Update), handler.OpenAPIDef{
 		ID:                  "UpdateAuthDomain",
 		Tags:                []string{"authdomains"},
 		Summary:             "Update auth domain",
@@ -78,7 +78,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Delete), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/auth_domains/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.authDomainHandler.Delete), handler.OpenAPIDef{
 		ID:                  "DeleteAuthDomain",
 		Tags:                []string{"authdomains"},
 		Summary:             "Delete auth domain",

pkg/authn/callbackauthn/googlecallbackauthn/authn.go

@@ -59,7 +59,7 @@ func (a *AuthN) LoginURL(ctx context.Context, siteURL *url.URL, authDomain *auth
 		return "", err
 	}
 
-	if authDomain.AuthDomainConfig().AuthNProvider != authtypes.AuthNProviderGoogleAuth {
+	if authDomain.StorableAuthDomainConfig().AuthNProvider != authtypes.AuthNProviderGoogle {
 		return "", errors.Newf(errors.TypeInternal, authtypes.ErrCodeAuthDomainMismatch, "domain type is not google")
 	}
 
@@ -111,7 +111,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "google: no id_token in token response")
 	}
 
-	verifier := oidcProvider.Verifier(&oidc.Config{ClientID: authDomain.AuthDomainConfig().Google.ClientID})
+	verifier := oidcProvider.Verifier(&oidc.Config{ClientID: authDomain.StorableAuthDomainConfig().Google.ClientID})
 	idToken, err := verifier.Verify(ctx, rawIDToken)
 	if err != nil {
 		a.settings.Logger().ErrorContext(ctx, "google: failed to verify token", errors.Attr(err))
@@ -135,7 +135,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "google: unexpected hd claim")
 	}
 
-	if !authDomain.AuthDomainConfig().Google.InsecureSkipEmailVerified {
+	if !authDomain.StorableAuthDomainConfig().Google.InsecureSkipEmailVerified {
 		if !claims.EmailVerified {
 			a.settings.Logger().ErrorContext(ctx, "google: email is not verified", slog.String("email", claims.Email))
 			return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "google: email is not verified")
@@ -148,14 +148,14 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 	}
 
 	var groups []string
-	if authDomain.AuthDomainConfig().Google.FetchGroups {
-		groups, err = a.fetchGoogleWorkspaceGroups(ctx, claims.Email, authDomain.AuthDomainConfig().Google)
+	if authDomain.StorableAuthDomainConfig().Google.FetchGroups {
+		groups, err = a.fetchGoogleWorkspaceGroups(ctx, claims.Email, authDomain.StorableAuthDomainConfig().Google)
 		if err != nil {
 			a.settings.Logger().ErrorContext(ctx, "google: could not fetch groups", errors.Attr(err))
 			return nil, errors.Newf(errors.TypeInternal, errors.CodeInternal, "google: could not fetch groups").WithAdditional(err.Error())
 		}
 
-		allowedGroups := authDomain.AuthDomainConfig().Google.AllowedGroups
+		allowedGroups := authDomain.StorableAuthDomainConfig().Google.AllowedGroups
 		if len(allowedGroups) > 0 {
 			groups = filterGroups(groups, allowedGroups)
 			if len(groups) == 0 {
@@ -175,8 +175,8 @@ func (a *AuthN) ProviderInfo(ctx context.Context, authDomain *authtypes.AuthDoma
 
 func (a *AuthN) oauth2Config(siteURL *url.URL, authDomain *authtypes.AuthDomain, provider *oidc.Provider) *oauth2.Config {
 	return &oauth2.Config{
-		ClientID:     authDomain.AuthDomainConfig().Google.ClientID,
-		ClientSecret: authDomain.AuthDomainConfig().Google.ClientSecret,
+		ClientID:     authDomain.StorableAuthDomainConfig().Google.ClientID,
+		ClientSecret: authDomain.StorableAuthDomainConfig().Google.ClientSecret,
 		Endpoint:     provider.Endpoint(),
 		Scopes:       scopes,
 		RedirectURL: (&url.URL{

pkg/modules/authdomain/implauthdomain/getter.go

@@ -26,7 +26,7 @@ func (getter *getter) OnBeforeRoleDelete(ctx context.Context, orgID valuer.UUID,
 
 	referencedBy := make([]string, 0)
 	for _, domain := range domains {
-		for _, mappedRole := range domain.AuthDomainConfig().RoleMapping.RoleNames() {
+		for _, mappedRole := range domain.StorableAuthDomainConfig().RoleMapping.RoleNames() {
 			if mappedRole == roleName {
 				referencedBy = append(referencedBy, domain.StorableAuthDomain().Name)
 				break

pkg/modules/authdomain/implauthdomain/handler.go

@@ -38,7 +38,7 @@ func (handler *handler) Create(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	authDomain, err := authtypes.NewAuthDomainFromConfig(body.Name, &body.Config, valuer.MustNewUUID(claims.OrgID))
+	authDomain, err := authtypes.NewAuthDomainFromPostableAuthDomain(body, valuer.MustNewUUID(claims.OrgID))
 	if err != nil {
 		render.Error(rw, err)
 		return
@@ -99,7 +99,13 @@ func (handler *handler) Get(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	render.Success(rw, http.StatusOK, authtypes.NewGettableAuthDomainFromAuthDomain(authDomain, handler.module.GetAuthNProviderInfo(ctx, authDomain)))
+	gettableAuthDomain, err := authtypes.NewGettableAuthDomainFromAuthDomain(authDomain, handler.module.GetAuthNProviderInfo(ctx, authDomain))
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusOK, gettableAuthDomain)
 }
 
 func (handler *handler) List(rw http.ResponseWriter, r *http.Request) {
@@ -120,7 +126,13 @@ func (handler *handler) List(rw http.ResponseWriter, r *http.Request) {
 
 	authDomains := make([]*authtypes.GettableAuthDomain, len(domains))
 	for i, domain := range domains {
-		authDomains[i] = authtypes.NewGettableAuthDomainFromAuthDomain(domain, handler.module.GetAuthNProviderInfo(ctx, domain))
+		gettableAuthDomain, err := authtypes.NewGettableAuthDomainFromAuthDomain(domain, handler.module.GetAuthNProviderInfo(ctx, domain))
+		if err != nil {
+			render.Error(rw, err)
+			return
+		}
+
+		authDomains[i] = gettableAuthDomain
 	}
 
 	render.Success(rw, http.StatusOK, authDomains)
@@ -154,7 +166,7 @@ func (handler *handler) Update(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = authDomain.Update(&body.Config)
+	err = authDomain.Update(body)
 	if err != nil {
 		render.Error(rw, err)
 		return

pkg/modules/authdomain/implauthdomain/module.go

@@ -33,7 +33,7 @@ func (module *module) Get(ctx context.Context, id valuer.UUID) (*authtypes.AuthD
 }
 
 func (module *module) GetAuthNProviderInfo(ctx context.Context, domain *authtypes.AuthDomain) *authtypes.AuthNProviderInfo {
-	if callbackAuthN, ok := module.authNs[domain.AuthDomainConfig().AuthNProvider].(authn.CallbackAuthN); ok {
+	if callbackAuthN, ok := module.authNs[domain.StorableAuthDomainConfig().AuthNProvider].(authn.CallbackAuthN); ok {
 		return callbackAuthN.ProviderInfo(ctx, domain)
 	}
 	return &authtypes.AuthNProviderInfo{}
@@ -72,7 +72,7 @@ func (module *module) Collect(ctx context.Context, orgID valuer.UUID) (map[strin
 	stats := make(map[string]any)
 
 	for _, domain := range domains {
-		key := "authdomain." + domain.AuthDomainConfig().AuthNProvider.StringValue() + ".count"
+		key := "authdomain." + domain.StorableAuthDomainConfig().AuthNProvider.StringValue() + ".count"
 		if value, ok := stats[key]; ok {
 			stats[key] = value.(int64) + 1
 		} else {
@@ -86,7 +86,7 @@ func (module *module) Collect(ctx context.Context, orgID valuer.UUID) (map[strin
 }
 
 func (module *module) validateRoleMapping(ctx context.Context, domain *authtypes.AuthDomain) error {
-	roleNames := domain.AuthDomainConfig().RoleMapping.RoleNames()
+	roleNames := domain.StorableAuthDomainConfig().RoleMapping.RoleNames()
 	if len(roleNames) == 0 {
 		return nil
 	}

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_postgres/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": false
+    "logs": true
   },
   "dataCollected": {
     "metrics": [

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudstorage/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": false
+    "logs": true
   },
   "dataCollected": {
     "metrics": [

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/computeengine/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": false
+    "logs": true
   },
   "dataCollected": {
     "metrics": [

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/gke/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": false
+    "logs": true
   },
   "dataCollected": {
     "metrics": [

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/memorystore_redis/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": false
+    "logs": true
   },
   "dataCollected": {
     "metrics": [

pkg/modules/inframonitoring/implinframonitoring/clusters.go

@@ -84,38 +84,20 @@ func buildClusterRecords(
 	return records
 }
 
-// getTopClusterGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope pod-status / node-readiness keysets when filtering,
-// to intersect all).
 func (m *module) getTopClusterGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableClusters,
-) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, map[string]nodeConditionCounts, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey            string
-		metadataMap           map[string]map[string]string
-		allMetricGroups       []rankedGroup
-		statusCounts          map[string]podStatusCounts
-		statusWarning         *qbtypes.QueryWarnData
-		nodeConditionCounts   map[string]nodeConditionCounts
-		filter                *qbtypes.Filter
-		filterByPodStatus     []inframonitoringtypes.PodStatus
-		filterByNodeReadiness []inframonitoringtypes.NodeCondition
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by pod status / node readiness, resolve the full-scope
-	// keyset(s) concurrently (pageGroups=nil spans all groups under the user
-	// filter) to intersect metadata + ranked groups below. Filters compose as AND.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -124,37 +106,12 @@ func (m *module) getTopClusterGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByPodStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
-			return err
-		})
-	}
-
-	if len(filterByNodeReadiness) != 0 {
-		g.Go(func() error {
-			var err error
-			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByNodeReadiness)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.ClusterNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status/readiness-matching groups. A missing
-		// metric yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning). Filters compose as AND.
-		if len(filterByPodStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
-		}
-		if len(filterByNodeReadiness) != 0 {
-			metadataMap = intersectMap(metadataMap, nodeConditionCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.ClusterNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToClustersQueryNames[orderByKey]
@@ -200,23 +157,10 @@ func (m *module) getTopClusterGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status/readiness
-	// keyset. A missing metric yields an empty keyset, correctly emptying the result
-	// (the caller also surfaces the warning). Filters compose as AND.
-	if len(filterByPodStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-	if len(filterByNodeReadiness) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, nodeConditionCounts)
-		metadataMap = intersectMap(metadataMap, nodeConditionCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getClustersTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableClusters) (map[string]map[string]string, error) {
@@ -226,9 +170,5 @@ func (m *module) getClustersTableMetadata(ctx context.Context, orgID valuer.UUID
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, clustersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, clustersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/containers.go

@@ -139,34 +139,20 @@ func buildContainerRecords(
 	return records
 }
 
-// getTopContainerGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope container-status keyset when filtering, to intersect both).
 func (m *module) getTopContainerGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableContainers,
-) ([]map[string]string, map[string]map[string]string, map[string]containerStatusCounts, *qbtypes.QueryWarnData, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey              string
-		metadataMap             map[string]map[string]string
-		allMetricGroups         []rankedGroup
-		statusCounts            map[string]containerStatusCounts
-		statusWarning           *qbtypes.QueryWarnData
-		filter                  *qbtypes.Filter
-		filterByContainerStatus []inframonitoringtypes.ContainerStatus
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by container status, resolve the full-scope status keyset
-	// concurrently (pageGroups=nil spans all groups under the user filter) so it
-	// can intersect metadata + ranked groups below.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByContainerStatus = req.Filter.FilterByContainerStatus
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -175,26 +161,12 @@ func (m *module) getTopContainerGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByContainerStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByContainerStatus)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.ContainerNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status-matching groups. A missing metric
-		// yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning).
-		if len(filterByContainerStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.ContainerNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToContainersQueryNames[orderByKey]
@@ -240,19 +212,10 @@ func (m *module) getTopContainerGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status keyset.
-	// A missing metric yields an empty statusCounts, correctly emptying the result
-	// (the caller also surfaces the warning).
-	if len(filterByContainerStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getContainersTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableContainers) (map[string]map[string]string, error) {
@@ -262,11 +225,7 @@ func (m *module) getContainersTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, containersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, containersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }
 
 // getPerGroupContainerStatusCountsWithReqMetricChecks gates
@@ -282,7 +241,6 @@ func (m *module) getPerGroupContainerStatusCountsWithReqMetricChecks(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
-	filterByContainerStatus []inframonitoringtypes.ContainerStatus,
 ) (map[string]containerStatusCounts, *qbtypes.QueryWarnData, error) {
 	present, err := m.getMetricsExistence(ctx, containerStatusMetricNamesList)
 	if err != nil {
@@ -308,28 +266,13 @@ func (m *module) getPerGroupContainerStatusCountsWithReqMetricChecks(
 		return map[string]containerStatusCounts{}, warning, nil
 	}
 
-	counts, err := m.getPerGroupContainerStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups, filterByContainerStatus)
+	counts, err := m.getPerGroupContainerStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups)
 	if err != nil {
 		return nil, nil, err
 	}
 	return counts, nil, nil
 }
 
-// applyContainerStatusFilter adds the display-status push-down (lower(display_status)
-// IN (...)) to the outer count builder. valuer lowercases the wire value while
-// display_status is kubectl-cased, so we compare lower() on both. No-op when the
-// requested set is empty.
-func applyContainerStatusFilter(cb *sqlbuilder.SelectBuilder, filterByContainerStatus []inframonitoringtypes.ContainerStatus) {
-	if len(filterByContainerStatus) == 0 {
-		return
-	}
-	vals := make([]string, len(filterByContainerStatus))
-	for i, c := range filterByContainerStatus {
-		vals[i] = c.StringValue()
-	}
-	cb.Where(cb.In("lower(display_status)", sqlbuilder.List(vals)))
-}
-
 // getPerGroupContainerStatusCounts computes per-group counts of distinct
 // containers bucketed by their latest kubectl-style display status in window.
 // Caller must ensure the required metrics exist
@@ -354,11 +297,8 @@ func (m *module) getPerGroupContainerStatusCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
-	filterByContainerStatus []inframonitoringtypes.ContainerStatus,
 ) (map[string]containerStatusCounts, error) {
-	// Empty pageGroups means "span all under user filter", allowed only in
-	// full-scope mode (filtering by status). Otherwise it's an empty page.
-	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByContainerStatus) == 0) {
+	if len(pageGroups) == 0 || len(groupBy) == 0 {
 		return map[string]containerStatusCounts{}, nil
 	}
 
@@ -542,15 +482,11 @@ func (m *module) getPerGroupContainerStatusCounts(
 		countGroupBy = append(countGroupBy, col)
 	}
 	countSelectCols = append(countSelectCols, statusCountCols...)
-
-	// Outer count query. Built with sqlbuilder so the status push-down uses a
-	// proper IN (keep only containers whose display status is in the requested set).
-	countBuilder := sqlbuilder.NewSelectBuilder()
-	countBuilder.Select(countSelectCols...)
-	countBuilder.From("container_status")
-	applyContainerStatusFilter(countBuilder, filterByContainerStatus)
-	countBuilder.GroupBy(countGroupBy...)
-	countSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)
+	countSQL := fmt.Sprintf(
+		"SELECT %s FROM container_status GROUP BY %s",
+		strings.Join(countSelectCols, ", "),
+		strings.Join(countGroupBy, ", "),
+	)
 
 	// Combine CTEs + outer. Arg order mirrors CTE declaration order.
 	cteFragments := []string{
@@ -563,7 +499,7 @@ func (m *module) getPerGroupContainerStatusCounts(
 	finalSQL := querybuilder.CombineCTEs(cteFragments) + countSQL
 	finalArgs := querybuilder.PrependArgs([][]any{
 		stateFpsArgs, containerStateArgs, reasonFpsArgs, reasonInnerArgs,
-	}, countArgs)
+	}, nil)
 
 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {

pkg/modules/inframonitoring/implinframonitoring/containers_test.go

@@ -1,59 +0,0 @@
-package implinframonitoring
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
-	"github.com/huandu/go-sqlbuilder"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestApplyContainerStatusFilter(t *testing.T) {
-	tests := []struct {
-		name      string
-		statuses  []inframonitoringtypes.ContainerStatus
-		wantWhere bool
-		wantArgs  []any
-	}{
-		{
-			name:      "empty set yields no clause",
-			statuses:  nil,
-			wantWhere: false,
-			wantArgs:  nil,
-		},
-		{
-			name:      "single status pushes lowercased arg via IN",
-			statuses:  []inframonitoringtypes.ContainerStatus{inframonitoringtypes.ContainerStatusRunning},
-			wantWhere: true,
-			wantArgs:  []any{"running"},
-		},
-		{
-			name: "multiple statuses push lowercased args via IN",
-			statuses: []inframonitoringtypes.ContainerStatus{
-				inframonitoringtypes.ContainerStatusRunning,
-				inframonitoringtypes.ContainerStatusCrashLoopBackOff,
-			},
-			wantWhere: true,
-			wantArgs:  []any{"running", "crashloopbackoff"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cb := sqlbuilder.NewSelectBuilder()
-			cb.Select("pod_uid")
-			cb.From("container_status")
-			applyContainerStatusFilter(cb, tt.statuses)
-			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
-
-			hasWhere := strings.Contains(sql, "lower(display_status) IN (")
-			assert.Equal(t, tt.wantWhere, hasWhere)
-			if len(tt.wantArgs) == 0 {
-				assert.Empty(t, args)
-			} else {
-				assert.Equal(t, tt.wantArgs, args)
-			}
-		})
-	}
-}

pkg/modules/inframonitoring/implinframonitoring/daemonsets.go

@@ -90,34 +90,20 @@ func buildDaemonSetRecords(
 	return records
 }
 
-// getTopDaemonSetGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopDaemonSetGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableDaemonSets,
-) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey        string
-		metadataMap       map[string]map[string]string
-		allMetricGroups   []rankedGroup
-		statusCounts      map[string]podStatusCounts
-		statusWarning     *qbtypes.QueryWarnData
-		filter            *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by pod status, resolve the full-scope status keyset
-	// concurrently (pageGroups=nil spans all groups under the user filter) so it
-	// can intersect metadata + ranked groups below.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -126,26 +112,12 @@ func (m *module) getTopDaemonSetGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByPodStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.DaemonSetNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status-matching groups. A missing metric
-		// yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning).
-		if len(filterByPodStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.DaemonSetNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToDaemonSetsQueryNames[orderByKey]
@@ -191,19 +163,10 @@ func (m *module) getTopDaemonSetGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status keyset.
-	// A missing metric yields an empty statusCounts, correctly emptying the result
-	// (the caller also surfaces the warning).
-	if len(filterByPodStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getDaemonSetsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableDaemonSets) (map[string]map[string]string, error) {
@@ -213,9 +176,5 @@ func (m *module) getDaemonSetsTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, daemonSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, daemonSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/deployments.go

@@ -82,34 +82,20 @@ func buildDeploymentRecords(
 	return records
 }
 
-// getTopDeploymentGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopDeploymentGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableDeployments,
-) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey        string
-		metadataMap       map[string]map[string]string
-		allMetricGroups   []rankedGroup
-		statusCounts      map[string]podStatusCounts
-		statusWarning     *qbtypes.QueryWarnData
-		filter            *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by pod status, resolve the full-scope status keyset
-	// concurrently (pageGroups=nil spans all groups under the user filter) so it
-	// can intersect metadata + ranked groups below.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -118,26 +104,12 @@ func (m *module) getTopDeploymentGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByPodStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.DeploymentNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status-matching groups. A missing metric
-		// yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning).
-		if len(filterByPodStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.DeploymentNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToDeploymentsQueryNames[orderByKey]
@@ -183,19 +155,10 @@ func (m *module) getTopDeploymentGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status keyset.
-	// A missing metric yields an empty statusCounts, correctly emptying the result
-	// (the caller also surfaces the warning).
-	if len(filterByPodStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getDeploymentsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableDeployments) (map[string]map[string]string, error) {
@@ -205,9 +168,5 @@ func (m *module) getDeploymentsTableMetadata(ctx context.Context, orgID valuer.U
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, deploymentsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, deploymentsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/helpers.go

@@ -63,33 +63,6 @@ func compositeKeyFromLabels(labels map[string]string, groupBy []qbtypes.GroupByK
 	return compositeKeyFromList(parts)
 }
 
-// intersectMap returns the entries of m whose key is present in keep (a new
-// map). keep's value type is irrelevant — only its keys are read — so a
-// per-group counts map (already filtered by the SQL push-down) can be passed
-// directly. Used to trim metadataMap to the status-matching groups.
-func intersectMap[V any, K any](m map[string]V, keep map[string]K) map[string]V {
-	out := make(map[string]V, len(m))
-	for k, v := range m {
-		if _, ok := keep[k]; ok {
-			out[k] = v
-		}
-	}
-	return out
-}
-
-// intersectRankedGroups returns the ranked groups whose compositeKey is present
-// in keep, preserving order. Keeps status-unmatched groups out of the ranked
-// page slots.
-func intersectRankedGroups[K any](groups []rankedGroup, keep map[string]K) []rankedGroup {
-	out := make([]rankedGroup, 0, len(groups))
-	for _, g := range groups {
-		if _, ok := keep[g.compositeKey]; ok {
-			out = append(out, g)
-		}
-	}
-	return out
-}
-
 // parseAndSortGroups extracts group label maps from a ScalarData response and
 // sorts them by the ranking query's aggregation value.
 func parseAndSortGroups(
@@ -877,10 +850,8 @@ func (m *module) getPerGroupDistinctCounts(
 			valueExpr = fmt.Sprintf("(%s)", strings.Join(parts, ", "))
 		}
 
-		// Prefix the alias so it never collides with a groupBy col alias
-		// (e.g. clusters grouped by k8s.node.name, which is also counted).
 		selectCols = append(selectCols,
-			fmt.Sprintf("uniqExactIf(%s, %s != '') AS %s", valueExpr, extract, quoteIdentifier(fmt.Sprintf("__count_%s", attr))),
+			fmt.Sprintf("uniqExactIf(%s, %s != '') AS %s", valueExpr, extract, quoteIdentifier(attr)),
 		)
 	}
 	sb.Select(selectCols...)

pkg/modules/inframonitoring/implinframonitoring/helpers_test.go

@@ -5,7 +5,6 @@ import (
 
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/stretchr/testify/assert"
 )
 
 func groupByKey(name string) qbtypes.GroupByKey {
@@ -89,7 +88,10 @@ func TestIsKeyInGroupByAttrs(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := isKeyInGroupByAttrs(tt.groupByAttrs, tt.key)
-			assert.Equal(t, tt.expectedFound, got)
+			if got != tt.expectedFound {
+				t.Errorf("isKeyInGroupByAttrs(%v, %q) = %v, want %v",
+					tt.groupByAttrs, tt.key, got, tt.expectedFound)
+			}
 		})
 	}
 }
@@ -154,7 +156,10 @@ func TestMergeFilterExpressions(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := mergeFilterExpressions(tt.queryFilterExpr, tt.reqFilterExpr)
-			assert.Equal(t, tt.expected, got)
+			if got != tt.expected {
+				t.Errorf("mergeFilterExpressions(%q, %q) = %q, want %q",
+					tt.queryFilterExpr, tt.reqFilterExpr, got, tt.expected)
+			}
 		})
 	}
 }
@@ -200,7 +205,10 @@ func TestCompositeKeyFromList(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := compositeKeyFromList(tt.parts)
-			assert.Equal(t, tt.expected, got)
+			if got != tt.expected {
+				t.Errorf("compositeKeyFromList(%v) = %q, want %q",
+					tt.parts, got, tt.expected)
+			}
 		})
 	}
 }
@@ -368,81 +376,10 @@ func TestCompositeKeyFromLabels(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := compositeKeyFromLabels(tt.labels, tt.groupBy)
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}
-
-func TestIntersectMap(t *testing.T) {
-	tests := []struct {
-		name     string
-		m        map[string]int
-		keep     map[string]podStatusCounts
-		expected map[string]int
-	}{
-		{
-			name:     "keep subset",
-			m:        map[string]int{"a": 1, "b": 2, "c": 3},
-			keep:     map[string]podStatusCounts{"a": {}, "c": {}},
-			expected: map[string]int{"a": 1, "c": 3},
-		},
-		{
-			name:     "empty keep drops everything",
-			m:        map[string]int{"a": 1, "b": 2},
-			keep:     map[string]podStatusCounts{},
-			expected: map[string]int{},
-		},
-		{
-			name:     "keep key absent from m is ignored",
-			m:        map[string]int{"a": 1},
-			keep:     map[string]podStatusCounts{"a": {}, "z": {}},
-			expected: map[string]int{"a": 1},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := intersectMap(tt.m, tt.keep)
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}
-
-func TestIntersectRankedGroups(t *testing.T) {
-	groups := []rankedGroup{
-		{compositeKey: "a", value: 3},
-		{compositeKey: "b", value: 2},
-		{compositeKey: "c", value: 1},
-	}
-
-	tests := []struct {
-		name     string
-		groups   []rankedGroup
-		keep     map[string]podStatusCounts
-		expected []string // compositeKeys in order
-	}{
-		{
-			name:     "preserves order, drops non-matching",
-			groups:   groups,
-			keep:     map[string]podStatusCounts{"a": {}, "c": {}},
-			expected: []string{"a", "c"},
-		},
-		{
-			name:     "empty keep drops all",
-			groups:   groups,
-			keep:     map[string]podStatusCounts{},
-			expected: []string{},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := intersectRankedGroups(tt.groups, tt.keep)
-			gotKeys := make([]string, 0, len(got))
-			for _, g := range got {
-				gotKeys = append(gotKeys, g.compositeKey)
+			if got != tt.expected {
+				t.Errorf("compositeKeyFromLabels(%v, %v) = %q, want %q",
+					tt.labels, tt.groupBy, got, tt.expected)
 			}
-			assert.Equal(t, tt.expected, gotKeys)
 		})
 	}
 }

pkg/modules/inframonitoring/implinframonitoring/jobs.go

@@ -90,34 +90,20 @@ func buildJobRecords(
 	return records
 }
 
-// getTopJobGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopJobGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableJobs,
-) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey        string
-		metadataMap       map[string]map[string]string
-		allMetricGroups   []rankedGroup
-		statusCounts      map[string]podStatusCounts
-		statusWarning     *qbtypes.QueryWarnData
-		filter            *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by pod status, resolve the full-scope status keyset
-	// concurrently (pageGroups=nil spans all groups under the user filter) so it
-	// can intersect metadata + ranked groups below.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -126,26 +112,12 @@ func (m *module) getTopJobGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByPodStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.JobNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status-matching groups. A missing metric
-		// yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning).
-		if len(filterByPodStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.JobNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToJobsQueryNames[orderByKey]
@@ -191,19 +163,10 @@ func (m *module) getTopJobGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status keyset.
-	// A missing metric yields an empty statusCounts, correctly emptying the result
-	// (the caller also surfaces the warning).
-	if len(filterByPodStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getJobsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableJobs) (map[string]map[string]string, error) {
@@ -213,9 +176,5 @@ func (m *module) getJobsTableMetadata(ctx context.Context, orgID valuer.UUID, re
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, jobsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, jobsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/module.go

@@ -286,36 +286,11 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}
 
-	var (
-		filterExpr        string
-		podFilter         *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
-		queryResp         *qbtypes.QueryRangeResponse
-		restartCounts     map[string]int64
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		podFilter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
-	// getTopPodGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
-	// status when filtering) concurrently, intersecting metadata/ranked groups
-	// against the status keyset. It returns the keyset + its warning.
-	pageGroups, metadataMap, statusCounts, statusWarning, err := m.getTopPodGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopPodGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByPodStatus) != 0 && statusWarning != nil {
-		resp.Warning = statusWarning
-		resp.Records = []inframonitoringtypes.PodRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -323,8 +298,20 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newPodsTableListQuery())
 
+	var (
+		queryResp     *qbtypes.QueryRangeResponse
+		statusCounts  map[string]podStatusCounts
+		statusWarning *qbtypes.QueryWarnData
+		restartCounts map[string]int64
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -334,18 +321,14 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 	})
 	g.Go(func() error {
 		var err error
-		restartCounts, err = m.getPerGroupPodRestartCounts(gCtx, orgID, req.Start, req.End, podFilter, req.GroupBy, pageGroups)
+		statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
+	g.Go(func() error {
+		var err error
+		restartCounts, err = m.getPerGroupPodRestartCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
 		return err
 	})
-	// When filtering, statusCounts already holds the full-scope map (a superset
-	// of the page); otherwise compute it page-scoped here.
-	if len(filterByPodStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, podFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -396,37 +379,11 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	var (
-		filterExpr              string
-		containerFilter         *qbtypes.Filter
-		filterByContainerStatus []inframonitoringtypes.ContainerStatus
-		queryResp               *qbtypes.QueryRangeResponse
-		restartCounts           map[string]int64
-		readyCounts             map[string]containerReadyCounts
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		containerFilter = &req.Filter.Filter
-		filterByContainerStatus = req.Filter.FilterByContainerStatus
-	}
-
-	// getTopContainerGroupsAndMetadata fetches metadata + ranking (+ full-scope
-	// container status when filtering) concurrently, intersecting metadata/ranked
-	// groups against the status keyset. It returns the keyset + its warning.
-	pageGroups, metadataMap, statusCounts, statusWarning, err := m.getTopContainerGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopContainerGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByContainerStatus) != 0 && statusWarning != nil {
-		resp.Warning = statusWarning
-		resp.Records = []inframonitoringtypes.ContainerRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -434,8 +391,21 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newContainersTableListQuery())
 
+	var (
+		queryResp     *qbtypes.QueryRangeResponse
+		statusCounts  map[string]containerStatusCounts
+		statusWarning *qbtypes.QueryWarnData
+		restartCounts map[string]int64
+		readyCounts   map[string]containerReadyCounts
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -445,23 +415,19 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 	})
 	g.Go(func() error {
 		var err error
-		restartCounts, err = m.getPerGroupContainerRestartCounts(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups)
+		statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
 		return err
 	})
 	g.Go(func() error {
 		var err error
-		readyCounts, err = m.getPerGroupContainerReadyCounts(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups)
+		restartCounts, err = m.getPerGroupContainerRestartCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
+	g.Go(func() error {
+		var err error
+		readyCounts, err = m.getPerGroupContainerReadyCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
 		return err
 	})
-	// When filtering, statusCounts already holds the full-scope map (a superset
-	// of the page); otherwise compute it page-scoped here.
-	if len(filterByContainerStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -512,37 +478,11 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		return resp, nil
 	}
 
-	var (
-		filterExpr            string
-		nodeFilter            *qbtypes.Filter
-		filterByPodStatus     []inframonitoringtypes.PodStatus
-		filterByNodeReadiness []inframonitoringtypes.NodeCondition
-		queryResp             *qbtypes.QueryRangeResponse
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		nodeFilter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
-	}
-
-	// getTopNodeGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
-	// status / node readiness when filtering) concurrently, intersecting
-	// metadata/ranked groups against the keysets. It returns the keysets + warning.
-	pageGroups, metadataMap, podStatusCounts, podStatusWarning, nodeConditionCounts, err := m.getTopNodeGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopNodeGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
-		resp.Warning = podStatusWarning
-		resp.Records = []inframonitoringtypes.NodeRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -550,8 +490,20 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newNodesTableListQuery())
 
+	var (
+		queryResp           *qbtypes.QueryRangeResponse
+		nodeConditionCounts map[string]nodeConditionCounts
+		podStatusCounts     map[string]podStatusCounts
+		podStatusWarning    *qbtypes.QueryWarnData
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -559,24 +511,16 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	// When filtering by readiness, nodeConditionCounts already holds the full-scope
-	// map (a superset of the page); otherwise compute it page-scoped here.
-	if len(filterByNodeReadiness) == 0 {
-		g.Go(func() error {
-			var err error
-			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, nodeFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
-	// When filtering by pod status, podStatusCounts already holds the full-scope
-	// map; otherwise compute it page-scoped here.
-	if len(filterByPodStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, nodeFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
+	g.Go(func() error {
+		var err error
+		nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
+	g.Go(func() error {
+		var err error
+		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -627,36 +571,11 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	var (
-		filterExpr        string
-		namespaceFilter   *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
-		queryResp         *qbtypes.QueryRangeResponse
-		resourceCounts    map[string]map[string]int64
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		namespaceFilter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
-	// getTopNamespaceGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
-	// status when filtering) concurrently, intersecting metadata/ranked groups
-	// against the status keyset. It returns the keyset + its warning.
-	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopNamespaceGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopNamespaceGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
-		resp.Warning = podStatusWarning
-		resp.Records = []inframonitoringtypes.NamespaceRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -664,8 +583,20 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newNamespacesTableListQuery())
 
+	var (
+		queryResp        *qbtypes.QueryRangeResponse
+		podStatusCounts  map[string]podStatusCounts
+		podStatusWarning *qbtypes.QueryWarnData
+		resourceCounts   map[string]map[string]int64
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -675,18 +606,14 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 	})
 	g.Go(func() error {
 		var err error
-		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, namespaceFilter, req.GroupBy, pageGroups, namespaceCountAttrKeys, namespacesMetricNamesListForCounts)
+		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
+	g.Go(func() error {
+		var err error
+		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups, namespaceCountAttrKeys, namespacesMetricNamesListForCounts)
 		return err
 	})
-	// When filtering, podStatusCounts already holds the full-scope map (a superset
-	// of the page); otherwise compute it page-scoped here.
-	if len(filterByPodStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, namespaceFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -736,39 +663,11 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		return resp, nil
 	}
 
-	var (
-		filterExpr             string
-		clusterFilter          *qbtypes.Filter
-		filterByPodStatus      []inframonitoringtypes.PodStatus
-		filterByNodeReadiness  []inframonitoringtypes.NodeCondition
-		queryResp              *qbtypes.QueryRangeResponse
-		nodeConditionCountsMap map[string]nodeConditionCounts
-		resourceCounts         map[string]map[string]int64
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		clusterFilter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
-	}
-
-	// getTopClusterGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
-	// status / node readiness when filtering) concurrently, intersecting
-	// metadata/ranked groups against the keysets. It returns the keysets + warning.
-	pageGroups, metadataMap, podStatusCounts, podStatusWarning, nodeConditionCountsMap, err := m.getTopClusterGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopClusterGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
-		resp.Warning = podStatusWarning
-		resp.Records = []inframonitoringtypes.ClusterRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -776,8 +675,23 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newClustersTableListQuery())
 
+	// With default groupBy [k8s.cluster.name], counts are bucketed per cluster;
+	// with a custom groupBy, they aggregate across clusters in that group.
+	var (
+		queryResp              *qbtypes.QueryRangeResponse
+		nodeConditionCountsMap map[string]nodeConditionCounts
+		podStatusCounts        map[string]podStatusCounts
+		podStatusWarning       *qbtypes.QueryWarnData
+		resourceCounts         map[string]map[string]int64
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -785,29 +699,21 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	// When filtering by readiness, nodeConditionCountsMap already holds the
-	// full-scope map (a superset of the page); otherwise compute it page-scoped here.
-	if len(filterByNodeReadiness) == 0 {
-		g.Go(func() error {
-			var err error
-			nodeConditionCountsMap, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
 	g.Go(func() error {
 		var err error
-		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, clusterCountAttrKeys, clusterMetricNamesListForCounts)
+		nodeConditionCountsMap, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
+	g.Go(func() error {
+		var err error
+		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
+	g.Go(func() error {
+		var err error
+		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups, clusterCountAttrKeys, clusterMetricNamesListForCounts)
 		return err
 	})
-	// When filtering by pod status, podStatusCounts already holds the full-scope
-	// map; otherwise compute it page-scoped here.
-	if len(filterByPodStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -921,7 +827,7 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 
 	// Bake the deployments base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &inframonitoringtypes.DeploymentFilter{}
+		req.Filter = &qbtypes.Filter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(deploymentsBaseFilterExpr, req.Filter.Expression)
 
@@ -936,35 +842,11 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		return resp, nil
 	}
 
-	var (
-		filterExpr        string
-		deploymentFilter  *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
-		queryResp         *qbtypes.QueryRangeResponse
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		deploymentFilter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
-	// getTopDeploymentGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
-	// status when filtering) concurrently, intersecting metadata/ranked groups
-	// against the status keyset. It returns the keyset + its warning.
-	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopDeploymentGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopDeploymentGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
-		resp.Warning = podStatusWarning
-		resp.Records = []inframonitoringtypes.DeploymentRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -972,8 +854,19 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newDeploymentsTableListQuery())
 
+	var (
+		queryResp        *qbtypes.QueryRangeResponse
+		podStatusCounts  map[string]podStatusCounts
+		podStatusWarning *qbtypes.QueryWarnData
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -981,15 +874,11 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	// When filtering, podStatusCounts already holds the full-scope map (a superset
-	// of the page); otherwise compute it page-scoped here.
-	if len(filterByPodStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, deploymentFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
+	g.Go(func() error {
+		var err error
+		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -1030,7 +919,7 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 
 	// Bake the workload base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &inframonitoringtypes.StatefulSetFilter{}
+		req.Filter = &qbtypes.Filter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(statefulSetsBaseFilterExpr, req.Filter.Expression)
 
@@ -1045,35 +934,11 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		return resp, nil
 	}
 
-	var (
-		filterExpr        string
-		statefulSetFilter *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
-		queryResp         *qbtypes.QueryRangeResponse
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		statefulSetFilter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
-	// getTopStatefulSetGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
-	// status when filtering) concurrently, intersecting metadata/ranked groups
-	// against the status keyset. It returns the keyset + its warning.
-	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopStatefulSetGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopStatefulSetGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
-		resp.Warning = podStatusWarning
-		resp.Records = []inframonitoringtypes.StatefulSetRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -1081,8 +946,21 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newStatefulSetsTableListQuery())
 
+	// Pods owned by a StatefulSet carry k8s.statefulset.name as a resource attribute,
+	// so default-groupBy gives per-statefulset status counts automatically.
+	var (
+		queryResp        *qbtypes.QueryRangeResponse
+		podStatusCounts  map[string]podStatusCounts
+		podStatusWarning *qbtypes.QueryWarnData
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -1090,15 +968,11 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	// When filtering, podStatusCounts already holds the full-scope map (a superset
-	// of the page); otherwise compute it page-scoped here.
-	if len(filterByPodStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, statefulSetFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
+	g.Go(func() error {
+		var err error
+		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -1139,7 +1013,7 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 
 	// Bake the jobs base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &inframonitoringtypes.JobFilter{}
+		req.Filter = &qbtypes.Filter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(jobsBaseFilterExpr, req.Filter.Expression)
 
@@ -1154,35 +1028,11 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}
 
-	var (
-		filterExpr        string
-		jobFilter         *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
-		queryResp         *qbtypes.QueryRangeResponse
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		jobFilter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
-	// getTopJobGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
-	// status when filtering) concurrently, intersecting metadata/ranked groups
-	// against the status keyset. It returns the keyset + its warning.
-	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopJobGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopJobGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
-		resp.Warning = podStatusWarning
-		resp.Records = []inframonitoringtypes.JobRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -1190,8 +1040,21 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newJobsTableListQuery())
 
+	// Pods owned by a Job carry k8s.job.name as a resource attribute, so default-groupBy
+	// gives per-job status counts automatically.
+	var (
+		queryResp        *qbtypes.QueryRangeResponse
+		podStatusCounts  map[string]podStatusCounts
+		podStatusWarning *qbtypes.QueryWarnData
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -1199,15 +1062,11 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	// When filtering, podStatusCounts already holds the full-scope map (a superset
-	// of the page); otherwise compute it page-scoped here.
-	if len(filterByPodStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, jobFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
+	g.Go(func() error {
+		var err error
+		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -1248,7 +1107,7 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 
 	// Bake the workload base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &inframonitoringtypes.DaemonSetFilter{}
+		req.Filter = &qbtypes.Filter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(daemonSetsBaseFilterExpr, req.Filter.Expression)
 
@@ -1263,35 +1122,11 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	var (
-		filterExpr        string
-		daemonSetFilter   *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
-		queryResp         *qbtypes.QueryRangeResponse
-	)
-
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-		daemonSetFilter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
-	// getTopDaemonSetGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
-	// status when filtering) concurrently, intersecting metadata/ranked groups
-	// against the status keyset. It returns the keyset + its warning.
-	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopDaemonSetGroupsAndMetadata(ctx, orgID, req)
+	pageGroups, metadataMap, err := m.getTopDaemonSetGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// Required metric missing while filtering: surface the warning + empty result.
-	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
-		resp.Warning = podStatusWarning
-		resp.Records = []inframonitoringtypes.DaemonSetRecord{}
-		resp.Total = 0
-		return resp, nil
-	}
-
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -1299,8 +1134,21 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
+	filterExpr := ""
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+	}
+
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newDaemonSetsTableListQuery())
 
+	// Pods owned by a DaemonSet carry k8s.daemonset.name as a resource attribute,
+	// so default-groupBy gives per-daemonset status counts automatically.
+	var (
+		queryResp        *qbtypes.QueryRangeResponse
+		podStatusCounts  map[string]podStatusCounts
+		podStatusWarning *qbtypes.QueryWarnData
+	)
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -1308,15 +1156,11 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	// When filtering, podStatusCounts already holds the full-scope map (a superset
-	// of the page); otherwise compute it page-scoped here.
-	if len(filterByPodStatus) == 0 {
-		g.Go(func() error {
-			var err error
-			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, daemonSetFilter, req.GroupBy, pageGroups, nil)
-			return err
-		})
-	}
+	g.Go(func() error {
+		var err error
+		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		return err
+	})
 
 	if err := g.Wait(); err != nil {
 		return nil, err

pkg/modules/inframonitoring/implinframonitoring/namespaces.go

@@ -65,34 +65,20 @@ func buildNamespaceRecords(
 	return records
 }
 
-// getTopNamespaceGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopNamespaceGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableNamespaces,
-) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey        string
-		metadataMap       map[string]map[string]string
-		allMetricGroups   []rankedGroup
-		statusCounts      map[string]podStatusCounts
-		statusWarning     *qbtypes.QueryWarnData
-		filter            *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by pod status, resolve the full-scope status keyset
-	// concurrently (pageGroups=nil spans all groups under the user filter) so it
-	// can intersect metadata + ranked groups below.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -101,26 +87,12 @@ func (m *module) getTopNamespaceGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByPodStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.NamespaceNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status-matching groups. A missing metric
-		// yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning).
-		if len(filterByPodStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.NamespaceNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToNamespacesQueryNames[orderByKey]
@@ -166,19 +138,10 @@ func (m *module) getTopNamespaceGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status keyset.
-	// A missing metric yields an empty statusCounts, correctly emptying the result
-	// (the caller also surfaces the warning).
-	if len(filterByPodStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getNamespacesTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableNamespaces) (map[string]map[string]string, error) {
@@ -188,9 +151,5 @@ func (m *module) getNamespacesTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, namespacesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, namespacesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/nodes.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"strings"
 
 	"github.com/SigNoz/signoz/pkg/querybuilder"
 	"github.com/SigNoz/signoz/pkg/telemetryschema/metricstelemetryschema"
@@ -91,38 +92,20 @@ func buildNodeRecords(
 	return records
 }
 
-// getTopNodeGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope pod-status / node-readiness keysets when filtering,
-// to intersect all).
 func (m *module) getTopNodeGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableNodes,
-) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, map[string]nodeConditionCounts, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey            string
-		metadataMap           map[string]map[string]string
-		allMetricGroups       []rankedGroup
-		statusCounts          map[string]podStatusCounts
-		statusWarning         *qbtypes.QueryWarnData
-		nodeConditionCounts   map[string]nodeConditionCounts
-		filter                *qbtypes.Filter
-		filterByPodStatus     []inframonitoringtypes.PodStatus
-		filterByNodeReadiness []inframonitoringtypes.NodeCondition
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by pod status / node readiness, resolve the full-scope
-	// keyset(s) concurrently (pageGroups=nil spans all groups under the user
-	// filter) to intersect metadata + ranked groups below. Filters compose as AND.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -131,37 +114,12 @@ func (m *module) getTopNodeGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByPodStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
-			return err
-		})
-	}
-
-	if len(filterByNodeReadiness) != 0 {
-		g.Go(func() error {
-			var err error
-			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByNodeReadiness)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.NodeNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status/readiness-matching groups. A missing
-		// metric yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning). Filters compose as AND.
-		if len(filterByPodStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
-		}
-		if len(filterByNodeReadiness) != 0 {
-			metadataMap = intersectMap(metadataMap, nodeConditionCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.NodeNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToNodesQueryNames[orderByKey]
@@ -207,23 +165,10 @@ func (m *module) getTopNodeGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status/readiness
-	// keyset. A missing metric yields an empty keyset, correctly emptying the result
-	// (the caller also surfaces the warning). Filters compose as AND.
-	if len(filterByPodStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-	if len(filterByNodeReadiness) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, nodeConditionCounts)
-		metadataMap = intersectMap(metadataMap, nodeConditionCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableNodes) (map[string]map[string]string, error) {
@@ -233,11 +178,7 @@ func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, r
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, nodesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, nodesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }
 
 // getPerGroupNodeConditionCounts computes per-group node counts bucketed by each
@@ -251,24 +192,6 @@ func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, r
 //	countNodesPerCondition:  per-group uniqExactIf into ready/not_ready buckets.
 //
 // Groups absent from the result map have implicit zero counts (caller default).
-// applyNodeReadinessFilter adds the readiness push-down (condition_value IN (...))
-// to the outer count builder. condition_value is numeric (1=Ready, 0=NotReady), so
-// we map each requested enum to its int. No-op when the requested set is empty.
-func applyNodeReadinessFilter(cb *sqlbuilder.SelectBuilder, filterByNodeReadiness []inframonitoringtypes.NodeCondition) {
-	if len(filterByNodeReadiness) == 0 {
-		return
-	}
-	nums := make([]int, len(filterByNodeReadiness))
-	for i, c := range filterByNodeReadiness {
-		v := inframonitoringtypes.NodeConditionNumNotReady
-		if c == inframonitoringtypes.NodeConditionReady {
-			v = inframonitoringtypes.NodeConditionNumReady
-		}
-		nums[i] = v
-	}
-	cb.Where(cb.In("condition_value", sqlbuilder.List(nums)))
-}
-
 func (m *module) getPerGroupNodeConditionCounts(
 	ctx context.Context,
 	orgID valuer.UUID,
@@ -276,11 +199,8 @@ func (m *module) getPerGroupNodeConditionCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
-	filterByNodeReadiness []inframonitoringtypes.NodeCondition,
 ) (map[string]nodeConditionCounts, error) {
-	// Empty pageGroups means "span all under user filter", allowed only in
-	// full-scope mode (filtering by readiness). Otherwise it's an empty page.
-	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByNodeReadiness) == 0) {
+	if len(pageGroups) == 0 || len(groupBy) == 0 {
 		return map[string]nodeConditionCounts{}, nil
 	}
 
@@ -368,14 +288,11 @@ func (m *module) getPerGroupNodeConditionCounts(
 		fmt.Sprintf("uniqExactIf(node_name, condition_value = %d) AS ready_count", inframonitoringtypes.NodeConditionNumReady),
 		fmt.Sprintf("uniqExactIf(node_name, condition_value = %d) AS not_ready_count", inframonitoringtypes.NodeConditionNumNotReady),
 	)
-	// Outer count query. Built with sqlbuilder so the readiness push-down uses a
-	// proper IN (keep only nodes whose readiness is in the requested set).
-	countBuilder := sqlbuilder.NewSelectBuilder()
-	countBuilder.Select(countNodesPerConditionSelectCols...)
-	countBuilder.From("latest_condition_per_node")
-	applyNodeReadinessFilter(countBuilder, filterByNodeReadiness)
-	countBuilder.GroupBy(countNodesPerConditionGroupBy...)
-	countNodesPerConditionSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)
+	countNodesPerConditionSQL := fmt.Sprintf(
+		"SELECT %s FROM latest_condition_per_node GROUP BY %s",
+		strings.Join(countNodesPerConditionSelectCols, ", "),
+		strings.Join(countNodesPerConditionGroupBy, ", "),
+	)
 
 	// Combine CTEs + outer.
 	cteFragments := []string{
@@ -383,7 +300,7 @@ func (m *module) getPerGroupNodeConditionCounts(
 		fmt.Sprintf("latest_condition_per_node AS (%s)", latestConditionPerNodeSQL),
 	}
 	finalSQL := querybuilder.CombineCTEs(cteFragments) + countNodesPerConditionSQL
-	finalArgs := querybuilder.PrependArgs([][]any{timeSeriesFPsArgs, latestConditionPerNodeArgs}, countArgs)
+	finalArgs := querybuilder.PrependArgs([][]any{timeSeriesFPsArgs, latestConditionPerNodeArgs}, nil)
 
 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {

pkg/modules/inframonitoring/implinframonitoring/nodes_test.go

@@ -1,65 +0,0 @@
-package implinframonitoring
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
-	"github.com/huandu/go-sqlbuilder"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestApplyNodeReadinessFilter(t *testing.T) {
-	tests := []struct {
-		name      string
-		readiness []inframonitoringtypes.NodeCondition
-		wantWhere bool
-		wantArgs  []any
-	}{
-		{
-			name:      "empty set yields no clause",
-			readiness: nil,
-			wantWhere: false,
-			wantArgs:  nil,
-		},
-		{
-			name:      "ready maps to 1 via IN",
-			readiness: []inframonitoringtypes.NodeCondition{inframonitoringtypes.NodeConditionReady},
-			wantWhere: true,
-			wantArgs:  []any{inframonitoringtypes.NodeConditionNumReady},
-		},
-		{
-			name:      "not_ready maps to 0 via IN",
-			readiness: []inframonitoringtypes.NodeCondition{inframonitoringtypes.NodeConditionNotReady},
-			wantWhere: true,
-			wantArgs:  []any{inframonitoringtypes.NodeConditionNumNotReady},
-		},
-		{
-			name: "multiple conditions map to their ints via IN",
-			readiness: []inframonitoringtypes.NodeCondition{
-				inframonitoringtypes.NodeConditionReady,
-				inframonitoringtypes.NodeConditionNotReady,
-			},
-			wantWhere: true,
-			wantArgs:  []any{inframonitoringtypes.NodeConditionNumReady, inframonitoringtypes.NodeConditionNumNotReady},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cb := sqlbuilder.NewSelectBuilder()
-			cb.Select("node_name")
-			cb.From("latest_condition_per_node")
-			applyNodeReadinessFilter(cb, tt.readiness)
-			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
-
-			hasWhere := strings.Contains(sql, "condition_value IN (")
-			assert.Equal(t, tt.wantWhere, hasWhere)
-			if len(tt.wantArgs) == 0 {
-				assert.Empty(t, args)
-			} else {
-				assert.Equal(t, tt.wantArgs, args)
-			}
-		})
-	}
-}

pkg/modules/inframonitoring/implinframonitoring/pods.go

@@ -146,34 +146,24 @@ func buildPodRecords(
 	return records
 }
 
-// getTopPodGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
+// getTopPodGroupsAndMetadata fetches the group metadata and the ordering-metric
+// ranking concurrently, then pages the ranked groups, backfilling from metadata
+// when the page extends past the metric-ranked groups. Returns the page of
+// groups and the metadata map (needed by the caller for Total and records).
 func (m *module) getTopPodGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostablePods,
-) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey        string
-		metadataMap       map[string]map[string]string
-		allMetricGroups   []rankedGroup
-		statusCounts      map[string]podStatusCounts
-		statusWarning     *qbtypes.QueryWarnData
-		filter            *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by pod status, resolve the full-scope status keyset
-	// concurrently (pageGroups=nil spans all groups under the user filter) so it
-	// can intersect metadata + ranked groups below.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -182,26 +172,12 @@ func (m *module) getTopPodGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByPodStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.PodNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status-matching groups. A missing metric
-		// yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning).
-		if len(filterByPodStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.PodNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToPodsQueryNames[orderByKey]
@@ -247,19 +223,10 @@ func (m *module) getTopPodGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status keyset.
-	// A missing metric yields an empty statusCounts, correctly emptying the result
-	// (the caller also surfaces the warning).
-	if len(filterByPodStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getPodsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostablePods) (map[string]map[string]string, error) {
@@ -269,11 +236,7 @@ func (m *module) getPodsTableMetadata(ctx context.Context, orgID valuer.UUID, re
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, podsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, podsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }
 
 // getPerGroupPodStatusCountsWithReqMetricChecks gates getPerGroupPodStatusCounts
@@ -288,7 +251,6 @@ func (m *module) getPerGroupPodStatusCountsWithReqMetricChecks(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
-	filterByPodStatus []inframonitoringtypes.PodStatus,
 ) (map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 	present, err := m.getMetricsExistence(ctx, podStatusMetricNamesList)
 	if err != nil {
@@ -314,28 +276,13 @@ func (m *module) getPerGroupPodStatusCountsWithReqMetricChecks(
 		return map[string]podStatusCounts{}, warning, nil
 	}
 
-	counts, err := m.getPerGroupPodStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups, filterByPodStatus)
+	counts, err := m.getPerGroupPodStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups)
 	if err != nil {
 		return nil, nil, err
 	}
 	return counts, nil, nil
 }
 
-// applyPodStatusFilter adds the display-status push-down (lower(display_status)
-// IN (...)) to the outer count builder. valuer lowercases the wire value while
-// display_status is kubectl-cased, so we compare lower() on both. No-op when the
-// requested set is empty.
-func applyPodStatusFilter(cb *sqlbuilder.SelectBuilder, filterByPodStatus []inframonitoringtypes.PodStatus) {
-	if len(filterByPodStatus) == 0 {
-		return
-	}
-	vals := make([]string, len(filterByPodStatus))
-	for i, s := range filterByPodStatus {
-		vals[i] = s.StringValue()
-	}
-	cb.Where(cb.In("lower(display_status)", sqlbuilder.List(vals)))
-}
-
 // getPerGroupPodStatusCounts computes per-group pod counts bucketed by each
 // pod's latest kubectl-style display status in the requested window. Caller
 // must ensure the required metrics exist (getPerGroupPodStatusCountsWithReqMetricChecks).
@@ -356,20 +303,13 @@ func (m *module) getPerGroupPodStatusCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
-	filterByPodStatus []inframonitoringtypes.PodStatus,
 ) (map[string]podStatusCounts, error) {
-	// return early if no group by or (no pagegroups provided plus no filterBystatus given for a full scan)
-	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByPodStatus) == 0) {
+	if len(pageGroups) == 0 || len(groupBy) == 0 {
 		return map[string]podStatusCounts{}, nil
 	}
 
-	var (
-		filterClause   *sqlbuilder.WhereClause
-		err            error
-		userFilterExpr string
-	)
-
 	// Merge user filter with page-groups IN clauses.
+	userFilterExpr := ""
 	if filter != nil {
 		userFilterExpr = filter.Expression
 	}
@@ -382,7 +322,10 @@ func (m *module) getPerGroupPodStatusCounts(
 	// CTEs, and buildFilterClause hits the metadata store + parses the
 	// expression, so we don't want to repeat it per CTE. AddWhereClause only
 	// reads the clause, so the same instance is safe to attach to each builder.
-
+	var (
+		filterClause *sqlbuilder.WhereClause
+		err          error
+	)
 	if mergedFilterExpr != "" {
 		filterClause, err = m.buildFilterClause(ctx, orgID, &qbtypes.Filter{Expression: mergedFilterExpr}, start, end)
 		if err != nil {
@@ -597,15 +540,11 @@ func (m *module) getPerGroupPodStatusCounts(
 		countGroupBy = append(countGroupBy, col)
 	}
 	countSelectCols = append(countSelectCols, statusCountCols...)
-
-	// Outer count query. Built with sqlbuilder so the status push-down uses a
-	// proper IN (keep only pods whose display status is in the requested set).
-	countBuilder := sqlbuilder.NewSelectBuilder()
-	countBuilder.Select(countSelectCols...)
-	countBuilder.From("pod_status")
-	applyPodStatusFilter(countBuilder, filterByPodStatus)
-	countBuilder.GroupBy(countGroupBy...)
-	countSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)
+	countSQL := fmt.Sprintf(
+		"SELECT %s FROM pod_status GROUP BY %s",
+		strings.Join(countSelectCols, ", "),
+		strings.Join(countGroupBy, ", "),
+	)
 
 	// Combine CTEs + outer. Arg order mirrors CTE declaration order.
 	cteFragments := []string{
@@ -622,7 +561,7 @@ func (m *module) getPerGroupPodStatusCounts(
 		phaseFpsArgs, phasePerPodArgs,
 		podReasonFpsArgs, podReasonPerPodArgs,
 		containerReasonFpsArgs, containerInnerArgs,
-	}, countArgs)
+	}, nil)
 
 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {

pkg/modules/inframonitoring/implinframonitoring/pods_test.go

@@ -1,59 +0,0 @@
-package implinframonitoring
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
-	"github.com/huandu/go-sqlbuilder"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestApplyPodStatusFilter(t *testing.T) {
-	tests := []struct {
-		name      string
-		statuses  []inframonitoringtypes.PodStatus
-		wantWhere bool
-		wantArgs  []any
-	}{
-		{
-			name:      "empty set yields no clause",
-			statuses:  nil,
-			wantWhere: false,
-			wantArgs:  nil,
-		},
-		{
-			name:      "single status pushes lowercased arg via IN",
-			statuses:  []inframonitoringtypes.PodStatus{inframonitoringtypes.PodStatusRunning},
-			wantWhere: true,
-			wantArgs:  []any{"running"},
-		},
-		{
-			name: "multiple statuses push lowercased args via IN",
-			statuses: []inframonitoringtypes.PodStatus{
-				inframonitoringtypes.PodStatusRunning,
-				inframonitoringtypes.PodStatusCrashLoopBackOff,
-			},
-			wantWhere: true,
-			wantArgs:  []any{"running", "crashloopbackoff"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cb := sqlbuilder.NewSelectBuilder()
-			cb.Select("pod_uid")
-			cb.From("pod_status")
-			applyPodStatusFilter(cb, tt.statuses)
-			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
-
-			hasWhere := strings.Contains(sql, "lower(display_status) IN (")
-			assert.Equal(t, tt.wantWhere, hasWhere)
-			if len(tt.wantArgs) == 0 {
-				assert.Empty(t, args)
-			} else {
-				assert.Equal(t, tt.wantArgs, args)
-			}
-		})
-	}
-}

pkg/modules/inframonitoring/implinframonitoring/statefulsets.go

@@ -82,34 +82,20 @@ func buildStatefulSetRecords(
 	return records
 }
 
-// getTopStatefulSetGroupsAndMetadata concurrently fetches metadata + the ordering-metric
-// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopStatefulSetGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableStatefulSets,
-) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
+) ([]map[string]string, map[string]map[string]string, error) {
 
 	var (
-		orderByKey        string
-		metadataMap       map[string]map[string]string
-		allMetricGroups   []rankedGroup
-		statusCounts      map[string]podStatusCounts
-		statusWarning     *qbtypes.QueryWarnData
-		filter            *qbtypes.Filter
-		filterByPodStatus []inframonitoringtypes.PodStatus
+		orderByKey      string
+		metadataMap     map[string]map[string]string
+		allMetricGroups []rankedGroup
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
-	// When filtering by pod status, resolve the full-scope status keyset
-	// concurrently (pageGroups=nil spans all groups under the user filter) so it
-	// can intersect metadata + ranked groups below.
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-		filterByPodStatus = req.Filter.FilterByPodStatus
-	}
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -118,26 +104,12 @@ func (m *module) getTopStatefulSetGroupsAndMetadata(
 		return err
 	})
 
-	if len(filterByPodStatus) != 0 {
-		g.Go(func() error {
-			var err error
-			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
-			return err
-		})
-	}
-
 	if orderByKey == inframonitoringtypes.StatefulSetNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, nil, nil, err
-		}
-		// Secondary filter: keep only status-matching groups. A missing metric
-		// yields an empty statusCounts, so this correctly empties the result
-		// (the caller also surfaces the warning).
-		if len(filterByPodStatus) != 0 {
-			metadataMap = intersectMap(metadataMap, statusCounts)
+			return nil, nil, err
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.StatefulSetNameAttrKey)
-		return pageGroups, metadataMap, statusCounts, statusWarning, nil
+		return pageGroups, metadataMap, nil
 	}
 
 	queryNamesForOrderBy := orderByToStatefulSetsQueryNames[orderByKey]
@@ -183,19 +155,10 @@ func (m *module) getTopStatefulSetGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	// Secondary filter: intersect ranked groups + metadata with the status keyset.
-	// A missing metric yields an empty statusCounts, correctly emptying the result
-	// (the caller also surfaces the warning).
-	if len(filterByPodStatus) != 0 {
-		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
-		metadataMap = intersectMap(metadataMap, statusCounts)
-	}
-
-	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
-	return pageGroups, metadataMap, statusCounts, statusWarning, nil
+	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
 }
 
 func (m *module) getStatefulSetsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableStatefulSets) (map[string]map[string]string, error) {
@@ -205,9 +168,5 @@ func (m *module) getStatefulSetsTableMetadata(ctx context.Context, orgID valuer.
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	var filter *qbtypes.Filter
-	if req.Filter != nil {
-		filter = &req.Filter.Filter
-	}
-	return m.getMetadata(ctx, orgID, statefulSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
+	return m.getMetadata(ctx, orgID, statefulSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
 }

pkg/modules/session/implsession/handler.go

@@ -75,7 +75,7 @@ func (handler *handler) CreateSessionByGoogleCallback(rw http.ResponseWriter, re
 
 	values := req.URL.Query()
 
-	redirectURL, err := handler.module.CreateCallbackAuthNSession(ctx, authtypes.AuthNProviderGoogleAuth, values)
+	redirectURL, err := handler.module.CreateCallbackAuthNSession(ctx, authtypes.AuthNProviderGoogle, values)
 	if err != nil {
 		http.Redirect(rw, req, handler.getRedirectURLFromErr(err), http.StatusSeeOther)
 		return

pkg/modules/session/implsession/module.go

@@ -152,7 +152,7 @@ func (module *module) CreateCallbackAuthNSession(ctx context.Context, authNProvi
 		return "", err
 	}
 
-	roleMapping := authDomain.AuthDomainConfig().RoleMapping
+	roleMapping := authDomain.StorableAuthDomainConfig().RoleMapping
 
 	roleAttributeExists := false
 	if roleMapping != nil && roleMapping.UseRoleAttribute && callbackIdentity.Role != "" {
@@ -215,11 +215,11 @@ func (module *module) getOrgSessionContext(ctx context.Context, org *types.Organ
 		return authtypes.NewOrgSessionContext(org.ID, org.Name).AddPasswordAuthNSupport(authtypes.AuthNProviderEmailPassword), nil
 	}
 
-	if !authDomain.AuthDomainConfig().SSOEnabled {
+	if !authDomain.StorableAuthDomainConfig().SSOEnabled {
 		return authtypes.NewOrgSessionContext(org.ID, org.Name).AddPasswordAuthNSupport(authtypes.AuthNProviderEmailPassword), nil
 	}
 
-	provider, err := getProvider[authn.CallbackAuthN](authDomain.AuthDomainConfig().AuthNProvider, module.authNs)
+	provider, err := getProvider[authn.CallbackAuthN](authDomain.StorableAuthDomainConfig().AuthNProvider, module.authNs)
 	if err != nil {
 		return nil, err
 	}
@@ -233,7 +233,7 @@ func (module *module) getOrgSessionContext(ctx context.Context, org *types.Organ
 		return nil, err
 	}
 
-	return authtypes.NewOrgSessionContext(org.ID, org.Name).AddCallbackAuthNSupport(authDomain.AuthDomainConfig().AuthNProvider, loginURL), nil
+	return authtypes.NewOrgSessionContext(org.ID, org.Name).AddCallbackAuthNSupport(authDomain.StorableAuthDomainConfig().AuthNProvider, loginURL), nil
 }
 
 func getProvider[T authn.AuthN](authNProvider authtypes.AuthNProvider, authNs map[authtypes.AuthNProvider]authn.AuthN) (T, error) {

pkg/signoz/authn.go

@@ -22,6 +22,6 @@ func NewAuthNs(ctx context.Context, providerSettings factory.ProviderSettings, s
 
 	return map[authtypes.AuthNProvider]authn.AuthN{
 		authtypes.AuthNProviderEmailPassword: emailPasswordAuthN,
-		authtypes.AuthNProviderGoogleAuth:    googleCallbackAuthN,
+		authtypes.AuthNProviderGoogle:        googleCallbackAuthN,
 	}, nil
 }

pkg/types/authtypes/authn.go

@@ -16,7 +16,7 @@ var (
 )
 
 var (
-	AuthNProviderGoogleAuth    = AuthNProvider{valuer.NewString("google_auth")}
+	AuthNProviderGoogle        = AuthNProvider{valuer.NewString("google")}
 	AuthNProviderSAML          = AuthNProvider{valuer.NewString("saml")}
 	AuthNProviderEmailPassword = AuthNProvider{valuer.NewString("email_password")}
 	AuthNProviderOIDC          = AuthNProvider{valuer.NewString("oidc")}
@@ -158,7 +158,7 @@ func (typ *Identity) ToClaims() Claims {
 
 func (AuthNProvider) Enum() []any {
 	return []any{
-		AuthNProviderGoogleAuth,
+		AuthNProviderGoogle,
 		AuthNProviderSAML,
 		AuthNProviderEmailPassword,
 		AuthNProviderOIDC,

pkg/types/authtypes/domain.go

@@ -9,6 +9,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/swaggest/jsonschema-go"
 	"github.com/uptrace/bun"
 )
 
@@ -30,7 +31,9 @@ var (
 
 type GettableAuthDomain struct {
 	StorableAuthDomain
+	Enabled           bool               `json:"enabled"`
 	Config            AuthDomainConfig   `json:"config"`
+	RoleMapping       *RoleMapping       `json:"roleMapping"`
 	AuthNProviderInfo *AuthNProviderInfo `json:"authNProviderInfo"`
 }
 
@@ -39,12 +42,16 @@ type AuthNProviderInfo struct {
 }
 
 type PostableAuthDomain struct {
-	Config AuthDomainConfig `json:"config"`
-	Name   string           `json:"name"`
+	Name        string           `json:"name" required:"true"`
+	Enabled     bool             `json:"enabled"`
+	Config      AuthDomainConfig `json:"config" required:"true"`
+	RoleMapping *RoleMapping     `json:"roleMapping"`
 }
 
 type UpdatableAuthDomain struct {
-	Config AuthDomainConfig `json:"config"`
+	Enabled     bool             `json:"enabled"`
+	Config      AuthDomainConfig `json:"config" required:"true"`
+	RoleMapping *RoleMapping     `json:"roleMapping"`
 }
 
 type StorableAuthDomain struct {
@@ -57,36 +64,96 @@ type StorableAuthDomain struct {
 	types.TimeAuditable
 }
 
-// TODO: the oneOf emitted by JSONSchemaOneOf is not the shape OpenAPI wants
-// for a discriminated union. OpenAPI's discriminator requires every oneOf
-// branch to be a $ref to a named component and a sibling property whose value
-// selects the variant. ssoType is already discriminator-shaped, but the
-// variant payload lives in a sibling field (samlConfig / googleAuthConfig /
-// oidcConfig) instead of being the payload itself, so no discriminator can
-// be attached. Refactor AuthDomainConfig into an envelope (see
-// ruletypes.RuleThresholdData for the pattern) where the chosen config is
-// the payload and ssoType is the discriminator.
 type AuthDomainConfig struct {
-	SSOEnabled    bool          `json:"ssoEnabled"`
-	AuthNProvider AuthNProvider `json:"ssoType"`
-	SAML          *SamlConfig   `json:"samlConfig"`
-	Google        *GoogleConfig `json:"googleAuthConfig"`
-	OIDC          *OIDCConfig   `json:"oidcConfig"`
-	RoleMapping   *RoleMapping  `json:"roleMapping"`
+	Kind AuthNProvider `json:"kind" required:"true"`
+	Spec any           `json:"spec" required:"true"`
 }
 
+// authDomainConfigSAML is the OpenAPI schema for an AuthDomainConfig with kind=saml.
+type authDomainConfigSAML struct {
+	Kind AuthNProvider `json:"kind" description:"The kind of authn provider." required:"true"`
+	Spec SamlConfig    `json:"spec" description:"The saml configuration." required:"true"`
+}
+
+// authDomainConfigGoogle is the OpenAPI schema for an AuthDomainConfig with kind=google.
+type authDomainConfigGoogle struct {
+	Kind AuthNProvider `json:"kind" description:"The kind of authn provider." required:"true"`
+	Spec GoogleConfig  `json:"spec" description:"The google auth configuration." required:"true"`
+}
+
+// authDomainConfigOIDC is the OpenAPI schema for an AuthDomainConfig with kind=oidc.
+type authDomainConfigOIDC struct {
+	Kind AuthNProvider `json:"kind" description:"The kind of authn provider." required:"true"`
+	Spec OIDCConfig    `json:"spec" description:"The oidc configuration." required:"true"`
+}
+
+var (
+	_ jsonschema.OneOfExposer = AuthDomainConfig{}
+	_ jsonschema.Preparer     = AuthDomainConfig{}
+)
+
+// JSONSchemaOneOf returns the oneOf variants for the AuthDomainConfig discriminated union.
+// Each variant represents a different authn provider kind with its corresponding spec schema.
+func (AuthDomainConfig) JSONSchemaOneOf() []any {
+	return []any{
+		authDomainConfigSAML{},
+		authDomainConfigGoogle{},
+		authDomainConfigOIDC{},
+	}
+}
+
+// PrepareJSONSchema marks the schema with x-signoz-discriminator;
+// signoz.attachDiscriminators promotes it to a real OpenAPI 3
+// discriminator after reflection.
+func (AuthDomainConfig) PrepareJSONSchema(schema *jsonschema.Schema) error {
+	if schema.ExtraProperties == nil {
+		schema.ExtraProperties = map[string]any{}
+	}
+
+	schema.ExtraProperties["x-signoz-discriminator"] = map[string]any{
+		"propertyName": "kind",
+		"mapping": map[string]string{
+			AuthNProviderSAML.StringValue():   "#/components/schemas/AuthtypesAuthDomainConfigSAML",
+			AuthNProviderGoogle.StringValue(): "#/components/schemas/AuthtypesAuthDomainConfigGoogle",
+			AuthNProviderOIDC.StringValue():   "#/components/schemas/AuthtypesAuthDomainConfigOIDC",
+		},
+	}
+
+	return nil
+}
+
+// StorableAuthDomainConfig is the JSON document persisted in StorableAuthDomain.Data.
+// Its shape (and the shapes it nests) must stay backward compatible with existing rows.
+type StorableAuthDomainConfig struct {
+	SSOEnabled    bool                `json:"ssoEnabled"`
+	AuthNProvider AuthNProvider       `json:"ssoType"`
+	SAML          *StorableSamlConfig `json:"samlConfig"`
+	Google        *GoogleConfig       `json:"googleAuthConfig"`
+	OIDC          *OIDCConfig         `json:"oidcConfig"`
+	RoleMapping   *RoleMapping        `json:"roleMapping"`
+}
+
+// storableAuthNProviderGoogle is the value persisted in ssoType for google domains,
+// kept for compatibility with rows written before the provider was renamed.
+var storableAuthNProviderGoogle = AuthNProvider{valuer.NewString("google_auth")}
+
 type AuthDomain struct {
-	storableAuthDomain *StorableAuthDomain
-	authDomainConfig   *AuthDomainConfig
+	storableAuthDomain       *StorableAuthDomain
+	storableAuthDomainConfig *StorableAuthDomainConfig
 }
 
-func NewAuthDomainFromConfig(name string, config *AuthDomainConfig, orgID valuer.UUID) (*AuthDomain, error) {
-	data, err := json.Marshal(config)
+func NewAuthDomainFromPostableAuthDomain(postableAuthDomain *PostableAuthDomain, orgID valuer.UUID) (*AuthDomain, error) {
+	storableAuthDomainConfig, err := newStorableAuthDomainConfig(postableAuthDomain.Enabled, postableAuthDomain.Config, postableAuthDomain.RoleMapping)
 	if err != nil {
 		return nil, err
 	}
 
-	return NewAuthDomain(name, string(data), orgID)
+	data, err := json.Marshal(storableAuthDomainConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewAuthDomain(postableAuthDomain.Name, string(data), orgID)
 }
 
 func NewAuthDomain(name string, data string, orgID valuer.UUID) (*AuthDomain, error) {
@@ -107,22 +174,85 @@ func NewAuthDomain(name string, data string, orgID valuer.UUID) (*AuthDomain, er
 }
 
 func NewAuthDomainFromStorableAuthDomain(storableAuthDomain *StorableAuthDomain) (*AuthDomain, error) {
-	authDomainConfig := new(AuthDomainConfig)
-	if err := json.Unmarshal([]byte(storableAuthDomain.Data), authDomainConfig); err != nil {
+	storableAuthDomainConfig := new(StorableAuthDomainConfig)
+	if err := json.Unmarshal([]byte(storableAuthDomain.Data), storableAuthDomainConfig); err != nil {
 		return nil, err
 	}
 
 	return &AuthDomain{
-		storableAuthDomain: storableAuthDomain,
-		authDomainConfig:   authDomainConfig,
+		storableAuthDomain:       storableAuthDomain,
+		storableAuthDomainConfig: storableAuthDomainConfig,
 	}, nil
 }
 
-func NewGettableAuthDomainFromAuthDomain(authDomain *AuthDomain, authNProviderInfo *AuthNProviderInfo) *GettableAuthDomain {
+func NewGettableAuthDomainFromAuthDomain(authDomain *AuthDomain, authNProviderInfo *AuthNProviderInfo) (*GettableAuthDomain, error) {
+	config, err := newAuthDomainConfigFromStorableAuthDomainConfig(authDomain.StorableAuthDomainConfig())
+	if err != nil {
+		return nil, err
+	}
+
 	return &GettableAuthDomain{
 		StorableAuthDomain: *authDomain.StorableAuthDomain(),
-		Config:             *authDomain.AuthDomainConfig(),
+		Enabled:            authDomain.StorableAuthDomainConfig().SSOEnabled,
+		Config:             config,
+		RoleMapping:        authDomain.StorableAuthDomainConfig().RoleMapping,
 		AuthNProviderInfo:  authNProviderInfo,
+	}, nil
+}
+
+func newStorableAuthDomainConfig(enabled bool, config AuthDomainConfig, roleMapping *RoleMapping) (*StorableAuthDomainConfig, error) {
+	storableAuthDomainConfig := &StorableAuthDomainConfig{
+		SSOEnabled:    enabled,
+		AuthNProvider: config.Kind,
+		RoleMapping:   roleMapping,
+	}
+
+	switch config.Kind {
+	case AuthNProviderSAML:
+		spec, ok := config.Spec.(SamlConfig)
+		if !ok {
+			return nil, errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "saml config is required")
+		}
+
+		samlConfig := StorableSamlConfig(spec)
+		storableAuthDomainConfig.SAML = &samlConfig
+
+	case AuthNProviderGoogle:
+		spec, ok := config.Spec.(GoogleConfig)
+		if !ok {
+			return nil, errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "google auth config is required")
+		}
+
+		storableAuthDomainConfig.Google = &spec
+
+	case AuthNProviderOIDC:
+		spec, ok := config.Spec.(OIDCConfig)
+		if !ok {
+			return nil, errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "oidc config is required")
+		}
+
+		storableAuthDomainConfig.OIDC = &spec
+
+	default:
+		return nil, errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "invalid authn provider %q", config.Kind.StringValue())
+	}
+
+	return storableAuthDomainConfig, nil
+}
+
+func newAuthDomainConfigFromStorableAuthDomainConfig(storableAuthDomainConfig *StorableAuthDomainConfig) (AuthDomainConfig, error) {
+	switch storableAuthDomainConfig.AuthNProvider {
+	case AuthNProviderSAML:
+		return AuthDomainConfig{Kind: AuthNProviderSAML, Spec: SamlConfig(*storableAuthDomainConfig.SAML)}, nil
+
+	case AuthNProviderGoogle:
+		return AuthDomainConfig{Kind: AuthNProviderGoogle, Spec: *storableAuthDomainConfig.Google}, nil
+
+	case AuthNProviderOIDC:
+		return AuthDomainConfig{Kind: AuthNProviderOIDC, Spec: *storableAuthDomainConfig.OIDC}, nil
+
+	default:
+		return AuthDomainConfig{}, errors.Newf(errors.TypeInternal, ErrCodeAuthDomainInvalidConfig, "invalid authn provider %q", storableAuthDomainConfig.AuthNProvider.StringValue())
 	}
 }
 
@@ -130,17 +260,22 @@ func (typ *AuthDomain) StorableAuthDomain() *StorableAuthDomain {
 	return typ.storableAuthDomain
 }
 
-func (typ *AuthDomain) AuthDomainConfig() *AuthDomainConfig {
-	return typ.authDomainConfig
+func (typ *AuthDomain) StorableAuthDomainConfig() *StorableAuthDomainConfig {
+	return typ.storableAuthDomainConfig
 }
 
-func (typ *AuthDomain) Update(config *AuthDomainConfig) error {
-	data, err := json.Marshal(config)
+func (typ *AuthDomain) Update(updatableAuthDomain *UpdatableAuthDomain) error {
+	storableAuthDomainConfig, err := newStorableAuthDomainConfig(updatableAuthDomain.Enabled, updatableAuthDomain.Config, updatableAuthDomain.RoleMapping)
 	if err != nil {
 		return err
 	}
 
-	typ.authDomainConfig = config
+	data, err := json.Marshal(storableAuthDomainConfig)
+	if err != nil {
+		return err
+	}
+
+	typ.storableAuthDomainConfig = storableAuthDomainConfig
 	typ.storableAuthDomain.Data = string(data)
 	typ.storableAuthDomain.UpdatedAt = time.Now()
 	return nil
@@ -163,15 +298,84 @@ func (typ *PostableAuthDomain) UnmarshalJSON(data []byte) error {
 }
 
 func (typ *AuthDomainConfig) UnmarshalJSON(data []byte) error {
-	type Alias AuthDomainConfig
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "failed to unmarshal auth domain config")
+	}
+
+	kindData, ok := raw["kind"]
+	if !ok {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "kind is required")
+	}
+
+	var kind AuthNProvider
+	if err := json.Unmarshal(kindData, &kind); err != nil {
+		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "failed to unmarshal kind")
+	}
+
+	specData, ok := raw["spec"]
+	if !ok {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "spec is required")
+	}
+
+	switch kind {
+	case AuthNProviderSAML:
+		spec := SamlConfig{}
+		if err := json.Unmarshal(specData, &spec); err != nil {
+			return err
+		}
+
+		typ.Spec = spec
+
+	case AuthNProviderGoogle:
+		spec := GoogleConfig{}
+		if err := json.Unmarshal(specData, &spec); err != nil {
+			return err
+		}
+
+		typ.Spec = spec
+
+	case AuthNProviderOIDC:
+		spec := OIDCConfig{}
+		if err := json.Unmarshal(specData, &spec); err != nil {
+			return err
+		}
+
+		typ.Spec = spec
+
+	default:
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "invalid authn provider %q", kind.StringValue())
+	}
+
+	typ.Kind = kind
+	return nil
+}
+
+func (typ StorableAuthDomainConfig) MarshalJSON() ([]byte, error) {
+	type Alias StorableAuthDomainConfig
+
+	temp := Alias(typ)
+	if temp.AuthNProvider == AuthNProviderGoogle {
+		temp.AuthNProvider = storableAuthNProviderGoogle
+	}
+
+	return json.Marshal(temp)
+}
+
+func (typ *StorableAuthDomainConfig) UnmarshalJSON(data []byte) error {
+	type Alias StorableAuthDomainConfig
 
 	var temp Alias
 	if err := json.Unmarshal(data, &temp); err != nil {
 		return err
 	}
 
+	if temp.AuthNProvider == storableAuthNProviderGoogle {
+		temp.AuthNProvider = AuthNProviderGoogle
+	}
+
 	switch temp.AuthNProvider {
-	case AuthNProviderGoogleAuth:
+	case AuthNProviderGoogle:
 		if temp.Google == nil {
 			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "google auth config is required")
 		}
@@ -190,17 +394,8 @@ func (typ *AuthDomainConfig) UnmarshalJSON(data []byte) error {
 		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "invalid authn provider %q", temp.AuthNProvider.StringValue())
 	}
 
-	*typ = AuthDomainConfig(temp)
+	*typ = StorableAuthDomainConfig(temp)
 	return nil
-
-}
-
-func (AuthDomainConfig) JSONSchemaOneOf() []any {
-	return []any{
-		SamlConfig{},
-		GoogleConfig{},
-		OIDCConfig{},
-	}
 }
 
 type AuthDomainStore interface {

pkg/types/authtypes/google.go

@@ -12,10 +12,10 @@ const wildCardDomain = "*"
 
 type GoogleConfig struct {
 	// ClientID is the application's ID. For example, 292085223830.apps.googleusercontent.com.
-	ClientID string `json:"clientId"`
+	ClientID string `json:"clientId" required:"true"`
 
 	// It is the application's secret.
-	ClientSecret string `json:"clientSecret"`
+	ClientSecret string `json:"clientSecret" required:"true"`
 
 	// What is the meaning of this? Should we remove this?
 	RedirectURI string `json:"redirectURI"`

pkg/types/authtypes/oidc.go

@@ -8,7 +8,7 @@ import (
 
 type OIDCConfig struct {
 	// It is the URL identifier for the service. For example: "https://accounts.google.com" or "https://login.salesforce.com".
-	Issuer string `json:"issuer"`
+	Issuer string `json:"issuer" required:"true"`
 
 	// Some offspec providers like Azure, Oracle IDCS have oidc discovery url different from issuer url which causes issuerValidation to fail
 	// This provides a way to override the Issuer url from the .well-known/openid-configuration issuer
@@ -16,10 +16,10 @@ type OIDCConfig struct {
 	IssuerAlias string `json:"issuerAlias"`
 
 	// It is the application's ID.
-	ClientID string `json:"clientId"`
+	ClientID string `json:"clientId" required:"true"`
 
 	// It is the application's secret.
-	ClientSecret string `json:"clientSecret"`
+	ClientSecret string `json:"clientSecret" required:"true"`
 
 	// Mapping of claims to the corresponding fields in the token.
 	ClaimMapping AttributeMapping `json:"claimMapping"`

pkg/types/authtypes/saml.go

@@ -7,14 +7,14 @@ import (
 )
 
 type SamlConfig struct {
-	// The entityID of the SAML identity provider. It can typically be found in the EntityID attribute of the EntityDescriptor element in the SAML metadata of the identity provider. Example: <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{samlEntity}">
-	SamlEntity string `json:"samlEntity"`
+	// The entityID of the SAML identity provider. It can typically be found in the EntityID attribute of the EntityDescriptor element in the SAML metadata of the identity provider. Example: <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entityId}">
+	EntityID string `json:"entityId" required:"true"`
 
-	// The SSO endpoint of the SAML identity provider. It can typically be found in the SingleSignOnService element in the SAML metadata of the identity provider. Example: <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="{samlIdp}"/>
-	SamlIdp string `json:"samlIdp"`
+	// The SSO endpoint of the SAML identity provider. It can typically be found in the Location attribute of the SingleSignOnService element in the SAML metadata of the identity provider. Example: <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="{location}"/>
+	Location string `json:"location" required:"true"`
 
-	// The certificate of the SAML identity provider. It can typically be found in the X509Certificate element in the SAML metadata of the identity provider. Example: <ds:X509Certificate><ds:X509Certificate>{samlCert}</ds:X509Certificate></ds:X509Certificate>
-	SamlCert string `json:"samlCert"`
+	// The certificate of the SAML identity provider. It can typically be found in the X509Certificate element in the SAML metadata of the identity provider. Example: <ds:X509Certificate><ds:X509Certificate>{certificate}</ds:X509Certificate></ds:X509Certificate>
+	Certificate string `json:"certificate" required:"true"`
 
 	// Whether to skip signing the SAML requests. It can typically be found in the WantAuthnRequestsSigned attribute of the IDPSSODescriptor element in the SAML metadata of the identity provider. Example: <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 	// For providers like jumpcloud, this should be set to true.
@@ -25,6 +25,17 @@ type SamlConfig struct {
 	AttributeMapping AttributeMapping `json:"attributeMapping"`
 }
 
+// StorableSamlConfig is SamlConfig in its persisted shape. It differs from SamlConfig
+// only in JSON keys, which are kept for compatibility with rows written before the
+// keys were renamed.
+type StorableSamlConfig struct {
+	EntityID                        string           `json:"samlEntity"`
+	Location                        string           `json:"samlIdp"`
+	Certificate                     string           `json:"samlCert"`
+	InsecureSkipAuthNRequestsSigned bool             `json:"insecureSkipAuthNRequestsSigned"`
+	AttributeMapping                AttributeMapping `json:"attributeMapping"`
+}
+
 func (config *SamlConfig) UnmarshalJSON(data []byte) error {
 	type Alias SamlConfig
 
@@ -33,24 +44,51 @@ func (config *SamlConfig) UnmarshalJSON(data []byte) error {
 		return err
 	}
 
-	if temp.SamlEntity == "" {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "samlEntity is required")
+	samlConfig := SamlConfig(temp)
+	if err := samlConfig.validate(); err != nil {
+		return err
 	}
 
-	if temp.SamlIdp == "" {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "samlIdp is required")
+	*config = samlConfig
+	return nil
+}
+
+func (config *StorableSamlConfig) UnmarshalJSON(data []byte) error {
+	type Alias StorableSamlConfig
+
+	var temp Alias
+	if err := json.Unmarshal(data, &temp); err != nil {
+		return err
 	}
 
-	if temp.SamlCert == "" {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "samlCert is required")
+	samlConfig := SamlConfig(StorableSamlConfig(temp))
+	if err := samlConfig.validate(); err != nil {
+		return err
 	}
 
-	if temp.AttributeMapping == (AttributeMapping{}) {
-		if err := json.Unmarshal([]byte("{}"), &temp.AttributeMapping); err != nil {
+	*config = StorableSamlConfig(samlConfig)
+	return nil
+}
+
+// validate also assigns the default attribute mapping when none is present.
+func (config *SamlConfig) validate() error {
+	if config.EntityID == "" {
+		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "entityId is required")
+	}
+
+	if config.Location == "" {
+		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "location is required")
+	}
+
+	if config.Certificate == "" {
+		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "certificate is required")
+	}
+
+	if config.AttributeMapping == (AttributeMapping{}) {
+		if err := json.Unmarshal([]byte("{}"), &config.AttributeMapping); err != nil {
 			return err
 		}
 	}
 
-	*config = SamlConfig(temp)
 	return nil
 }

pkg/types/inframonitoringtypes/clusters.go

@@ -42,22 +42,13 @@ type ClusterRecord struct {
 type PostableClusters struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *ClusterFilter       `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// ClusterFilter is the attribute filter plus optional secondary filters on the
-// derived pod display status(es) (see PodStatus; matches any listed, OR) and node
-// readiness (see NodeCondition; matches any listed, OR). Empty FilterByPodStatus / FilterByNodeReadiness = off.
-type ClusterFilter struct {
-	qbtypes.Filter        `json:",inline"`
-	FilterByPodStatus     []PodStatus     `json:"filterByPodStatus"`
-	FilterByNodeReadiness []NodeCondition `json:"filterByNodeReadiness"`
-}
-
 // Validate ensures PostableClusters contains acceptable values.
 func (req *PostableClusters) Validate() error {
 	if req == nil {
@@ -97,19 +88,6 @@ func (req *PostableClusters) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, s := range req.Filter.FilterByPodStatus {
-			if !s.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
-			}
-		}
-		for _, c := range req.Filter.FilterByNodeReadiness {
-			if !c.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by node readiness: %s", c)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(ClustersValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/containers.go

@@ -75,21 +75,13 @@ type ContainerRecord struct {
 type PostableContainers struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *ContainerFilter     `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// ContainerFilter is the attribute filter plus an optional secondary filter on
-// the derived container display status(es) (see ContainerStatus; matches any
-// listed, OR). Empty FilterByContainerStatus = off.
-type ContainerFilter struct {
-	qbtypes.Filter          `json:",inline"`
-	FilterByContainerStatus []ContainerStatus `json:"filterByContainerStatus"`
-}
-
 // Validate ensures PostableContainers contains acceptable values.
 func (req *PostableContainers) Validate() error {
 	if req == nil {
@@ -129,14 +121,6 @@ func (req *PostableContainers) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, c := range req.Filter.FilterByContainerStatus {
-			if !c.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by container status: %s", c)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(ContainersValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/containers_constants.go

@@ -1,10 +1,6 @@
 package inframonitoringtypes
 
-import (
-	"slices"
-
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
+import "github.com/SigNoz/signoz/pkg/valuer"
 
 // ContainerStatus is the kubectl-style display status of a container, derived
 // from k8s.container.status.state (base) + k8s.container.status.reason (overlay).
@@ -35,12 +31,6 @@ var (
 	ContainerStatusNoData = ContainerStatus{valuer.NewString("no_data")}
 )
 
-// IsFilterable reports whether c is a concrete, user-filterable
-// container status: any Enum() member except the no_data sentinel.
-func (c ContainerStatus) IsFilterable() bool {
-	return c != ContainerStatusNoData && slices.Contains((ContainerStatus{}).Enum(), any(c))
-}
-
 func (ContainerStatus) Enum() []any {
 	return []any{
 		ContainerStatusRunning,

pkg/types/inframonitoringtypes/daemonsets.go

@@ -36,20 +36,13 @@ type DaemonSetRecord struct {
 type PostableDaemonSets struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *DaemonSetFilter     `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// DaemonSetFilter is the attribute filter plus an optional secondary filter on the
-// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
-type DaemonSetFilter struct {
-	qbtypes.Filter    `json:",inline"`
-	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
-}
-
 // Validate ensures PostableDaemonSets contains acceptable values.
 func (req *PostableDaemonSets) Validate() error {
 	if req == nil {
@@ -89,14 +82,6 @@ func (req *PostableDaemonSets) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, s := range req.Filter.FilterByPodStatus {
-			if !s.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(DaemonSetsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/deployments.go

@@ -34,20 +34,13 @@ type DeploymentRecord struct {
 type PostableDeployments struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *DeploymentFilter    `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// DeploymentFilter is the attribute filter plus an optional secondary filter on the
-// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
-type DeploymentFilter struct {
-	qbtypes.Filter    `json:",inline"`
-	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
-}
-
 // Validate ensures PostableDeployments contains acceptable values.
 func (req *PostableDeployments) Validate() error {
 	if req == nil {
@@ -87,14 +80,6 @@ func (req *PostableDeployments) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, s := range req.Filter.FilterByPodStatus {
-			if !s.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(DeploymentsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/jobs.go

@@ -36,20 +36,13 @@ type JobRecord struct {
 type PostableJobs struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *JobFilter           `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// JobFilter is the attribute filter plus an optional secondary filter on the
-// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
-type JobFilter struct {
-	qbtypes.Filter    `json:",inline"`
-	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
-}
-
 // Validate ensures PostableJobs contains acceptable values.
 func (req *PostableJobs) Validate() error {
 	if req == nil {
@@ -89,14 +82,6 @@ func (req *PostableJobs) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, s := range req.Filter.FilterByPodStatus {
-			if !s.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(JobsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/namespaces.go

@@ -34,20 +34,13 @@ type NamespaceRecord struct {
 type PostableNamespaces struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *NamespaceFilter     `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// NamespaceFilter is the attribute filter plus an optional secondary filter on the
-// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
-type NamespaceFilter struct {
-	qbtypes.Filter    `json:",inline"`
-	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
-}
-
 // Validate ensures PostableNamespaces contains acceptable values.
 func (req *PostableNamespaces) Validate() error {
 	if req == nil {
@@ -87,14 +80,6 @@ func (req *PostableNamespaces) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, s := range req.Filter.FilterByPodStatus {
-			if !s.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(NamespacesValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/nodes.go

@@ -39,22 +39,13 @@ type NodeRecord struct {
 type PostableNodes struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *NodeFilter          `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// NodeFilter is the attribute filter plus an optional secondary filter on the
-// derived pod display status(es) (see PodStatus; matches any listed, OR) and node
-// readiness (see NodeCondition; matches any listed, OR). Empty FilterByPodStatus / FilterByNodeReadiness = off.
-type NodeFilter struct {
-	qbtypes.Filter        `json:",inline"`
-	FilterByPodStatus     []PodStatus     `json:"filterByPodStatus"`
-	FilterByNodeReadiness []NodeCondition `json:"filterByNodeReadiness"`
-}
-
 // Validate ensures PostableNodes contains acceptable values.
 func (req *PostableNodes) Validate() error {
 	if req == nil {
@@ -94,19 +85,6 @@ func (req *PostableNodes) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, s := range req.Filter.FilterByPodStatus {
-			if !s.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
-			}
-		}
-		for _, c := range req.Filter.FilterByNodeReadiness {
-			if !c.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by node readiness: %s", c)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(NodesValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/nodes_constants.go

@@ -1,10 +1,6 @@
 package inframonitoringtypes
 
-import (
-	"slices"
-
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
+import "github.com/SigNoz/signoz/pkg/valuer"
 
 type NodeCondition struct {
 	valuer.String
@@ -24,12 +20,6 @@ func (NodeCondition) Enum() []any {
 	}
 }
 
-// IsFilterable reports whether c is a concrete, user-filterable
-// node readiness: any Enum() member except the no_data sentinel.
-func (c NodeCondition) IsFilterable() bool {
-	return c != NodeConditionNoData && slices.Contains((NodeCondition{}).Enum(), any(c))
-}
-
 // Numeric values emitted by the k8s.node.condition_ready metric
 // (source: OTel kubeletstats receiver).
 const (

pkg/types/inframonitoringtypes/pods.go

@@ -63,20 +63,13 @@ type PodRecord struct {
 type PostablePods struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *PodFilter           `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// PodFilter is the attribute filter plus an optional secondary filter on the
-// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
-type PodFilter struct {
-	qbtypes.Filter    `json:",inline"`
-	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
-}
-
 // Validate ensures PostablePods contains acceptable values.
 func (req *PostablePods) Validate() error {
 	if req == nil {
@@ -116,14 +109,6 @@ func (req *PostablePods) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, s := range req.Filter.FilterByPodStatus {
-			if !s.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(PodsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/pods_constants.go

@@ -1,10 +1,6 @@
 package inframonitoringtypes
 
-import (
-	"slices"
-
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
+import "github.com/SigNoz/signoz/pkg/valuer"
 
 // PodStatus is the kubectl-style pod display status, derived from
 // k8s.pod.phase + k8s.pod.status_reason + k8s.container.status.reason
@@ -70,12 +66,6 @@ func (PodStatus) Enum() []any {
 	}
 }
 
-// IsFilterable reports whether s is a concrete, user-filterable pod
-// status: any Enum() member except the no_data sentinel.
-func (s PodStatus) IsFilterable() bool {
-	return s != PodStatusNoData && slices.Contains((PodStatus{}).Enum(), any(s))
-}
-
 const PodNameAttrKey = "k8s.pod.name"
 
 const (

pkg/types/inframonitoringtypes/statefulsets.go

@@ -34,20 +34,13 @@ type StatefulSetRecord struct {
 type PostableStatefulSets struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *StatefulSetFilter   `json:"filter"`
+	Filter  *qbtypes.Filter      `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
-// StatefulSetFilter is the attribute filter plus an optional secondary filter on the
-// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
-type StatefulSetFilter struct {
-	qbtypes.Filter    `json:",inline"`
-	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
-}
-
 // Validate ensures PostableStatefulSets contains acceptable values.
 func (req *PostableStatefulSets) Validate() error {
 	if req == nil {
@@ -87,14 +80,6 @@ func (req *PostableStatefulSets) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
-	if req.Filter != nil {
-		for _, s := range req.Filter.FilterByPodStatus {
-			if !s.IsFilterable() {
-				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
-			}
-		}
-	}
-
 	if req.OrderBy != nil {
 		if !slices.Contains(StatefulSetsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

tests/conftest.py

@@ -24,6 +24,7 @@ pytest_plugins = [
     "fixtures.browser",
     "fixtures.keycloak",
     "fixtures.idp",
+    "fixtures.googleidp",
     "fixtures.notification_channel",
     "fixtures.maildev",
     "fixtures.alerts",

tests/fixtures/googleidp.py

@@ -0,0 +1,220 @@
+import base64
+import json
+import time
+from collections.abc import Callable
+from http import HTTPStatus
+from urllib.parse import urlparse
+
+import docker
+import docker.errors
+import pytest
+import requests
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import padding, rsa
+from testcontainers.core.container import DockerContainer, Network
+from wiremock.resources.mappings import HttpMethods, Mapping, MappingRequest, MappingResponse
+
+from fixtures import reuse, tls, types
+from fixtures.logger import setup_logger
+
+logger = setup_logger(__name__)
+
+# The google callback authn hardcodes Google's issuer, so the mock must be
+# reachable as accounts.google.com over TLS from the signoz container: the
+# wiremock container joins the network under that alias and serves HTTPS on 443
+# with a certificate issued by the integration CA that signoz trusts.
+ISSUER = "https://accounts.google.com"
+ISSUER_HOST = "accounts.google.com"
+
+
+def perform_google_login(
+    signoz: types.SigNoz,
+    googleidp: types.TestContainerDocker,
+    get_session_context: Callable[[str], dict],
+    email: str,
+) -> str:
+    """Drive the google login flow for email and return the final redirect URL.
+
+    The authorize URL points at https://accounts.google.com (resolvable only
+    inside the docker network), so it is rewritten to the mock's host-mapped
+    port, mirroring how the oidc suite rewrites keycloak URLs.
+    """
+    session_context = get_session_context(email)
+
+    assert len(session_context["orgs"]) == 1
+    assert len(session_context["orgs"][0]["authNSupport"]["callback"]) == 1
+
+    url = session_context["orgs"][0]["authNSupport"]["callback"][0]["url"]
+    assert url.startswith(f"{ISSUER}/")
+
+    parsed_url = urlparse(url)
+    authorize_url = googleidp.host_configs["8080"].get(f"{parsed_url.path}?{parsed_url.query}")
+
+    response = requests.get(authorize_url, allow_redirects=False, timeout=5)
+    assert response.status_code == HTTPStatus.FOUND
+
+    callback_url = response.headers["Location"]
+    assert "/api/v1/complete/google" in callback_url
+
+    response = requests.get(callback_url, allow_redirects=False, timeout=30)
+    assert response.status_code == HTTPStatus.SEE_OTHER
+
+    return response.headers["Location"]
+
+
+def google_oidc_mappings(email: str, name: str, hd: str, audience: str, email_verified: bool = True) -> list[Mapping]:
+    """Wiremock mappings for one Google OIDC login: discovery, an auto-approving
+    authorize redirect, a token response with an RS256 id_token for the given
+    identity, and the JWKS the signoz container verifies it against. The signing
+    key is ephemeral — the token and JWKS stubs are always installed together."""
+    signing_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+
+    def base64url(data: bytes) -> str:
+        return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+    now = int(time.time())
+    claims = {
+        "iss": ISSUER,
+        "aud": audience,
+        "sub": f"google-oauth2|{email}",
+        "email": email,
+        "email_verified": email_verified,
+        "name": name,
+        "hd": hd,
+        "iat": now,
+        "exp": now + 3600,
+    }
+    signing_input = base64url(json.dumps({"alg": "RS256", "kid": "googleidp-integration", "typ": "JWT"}).encode()) + "." + base64url(json.dumps(claims).encode())
+    signature = signing_key.sign(signing_input.encode(), padding.PKCS1v15(), hashes.SHA256())
+    id_token = signing_input + "." + base64url(signature)
+
+    public_numbers = signing_key.public_key().public_numbers()
+
+    return [
+        Mapping(
+            request=MappingRequest(method=HttpMethods.GET, url_path="/.well-known/openid-configuration"),
+            response=MappingResponse(
+                status=200,
+                json_body={
+                    "issuer": ISSUER,
+                    "authorization_endpoint": f"{ISSUER}/o/oauth2/v2/auth",
+                    "token_endpoint": f"{ISSUER}/token",
+                    "jwks_uri": f"{ISSUER}/jwks",
+                    "response_types_supported": ["code"],
+                    "subject_types_supported": ["public"],
+                    "id_token_signing_alg_values_supported": ["RS256"],
+                    "scopes_supported": ["openid", "email", "profile"],
+                    "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
+                },
+            ),
+        ),
+        Mapping(
+            request=MappingRequest(method=HttpMethods.GET, url_path="/o/oauth2/v2/auth"),
+            response=MappingResponse(
+                status=302,
+                headers={
+                    # Triple-stache: redirect_uri and state are URLs; handlebars
+                    # would otherwise HTML-escape their special characters.
+                    "Location": "{{{request.query.redirect_uri}}}?code=integration-test-code&state={{{request.query.state}}}",
+                },
+                transformers=["response-template"],
+            ),
+        ),
+        Mapping(
+            request=MappingRequest(method=HttpMethods.POST, url_path="/token"),
+            response=MappingResponse(
+                status=200,
+                json_body={
+                    "access_token": "integration-test-access-token",
+                    "token_type": "Bearer",
+                    "expires_in": 3600,
+                    "id_token": id_token,
+                },
+            ),
+        ),
+        Mapping(
+            request=MappingRequest(method=HttpMethods.GET, url_path="/jwks"),
+            response=MappingResponse(
+                status=200,
+                json_body={
+                    "keys": [
+                        {
+                            "kty": "RSA",
+                            "use": "sig",
+                            "alg": "RS256",
+                            "kid": "googleidp-integration",
+                            "n": base64url(public_numbers.n.to_bytes((public_numbers.n.bit_length() + 7) // 8, "big")),
+                            "e": base64url(public_numbers.e.to_bytes((public_numbers.e.bit_length() + 7) // 8, "big")),
+                        }
+                    ]
+                },
+            ),
+        ),
+    ]
+
+
+@pytest.fixture(name="googleidp", scope="package")
+def googleidp(
+    network: Network,
+    request: pytest.FixtureRequest,
+    pytestconfig: pytest.Config,
+) -> types.TestContainerDocker:
+    """Wiremock impersonating Google's OIDC provider. Stubs are installed per
+    test via make_http_mocks with google_oidc_mappings; port 8080 serves the
+    admin API and the authorize redirect to the test process."""
+
+    def create() -> types.TestContainerDocker:
+        keystore_dir = tls.ensure_server_keystore(pytestconfig, ISSUER_HOST)
+
+        container = DockerContainer("wiremock/wiremock:2.35.1-1")
+        container.with_command(f"--https-port 443 --https-keystore /certs/keystore.p12 --keystore-type PKCS12 --keystore-password {tls.KEYSTORE_PASSWORD} --local-response-templating")
+        container.with_volume_mapping(str(keystore_dir), "/certs", "ro")
+        container.with_exposed_ports(8080)
+        container.with_network(network)
+        container.with_network_aliases(ISSUER_HOST)
+        container.start()
+
+        host = container.get_container_host_ip()
+        host_port = container.get_exposed_port(8080)
+
+        for attempt in range(20):
+            try:
+                response = requests.get(f"http://{host}:{host_port}/__admin/mappings", timeout=2)
+                if response.status_code == HTTPStatus.OK:
+                    break
+            except Exception as e:  # pylint: disable=broad-exception-caught
+                logger.info("googleidp attempt %d: %s", attempt + 1, e)
+            time.sleep(1)
+        else:
+            raise TimeoutError("googleidp container did not become ready")
+
+        return types.TestContainerDocker(
+            id=container.get_wrapped_container().id,
+            host_configs={
+                "8080": types.TestContainerUrlConfig("http", host, host_port),
+            },
+            container_configs={
+                "443": types.TestContainerUrlConfig("https", ISSUER_HOST, 443),
+            },
+        )
+
+    def delete(container: types.TestContainerDocker) -> None:
+        client = docker.from_env()
+        try:
+            client.containers.get(container_id=container.id).stop()
+            client.containers.get(container_id=container.id).remove(v=True)
+        except docker.errors.NotFound:
+            logger.info("googleidp container %s already gone", container.id)
+
+    def restore(cache: dict) -> types.TestContainerDocker:
+        return types.TestContainerDocker.from_cache(cache)
+
+    return reuse.wrap(
+        request,
+        pytestconfig,
+        "googleidp",
+        lambda: types.TestContainerDocker(id="", host_configs={}, container_configs={}),
+        create,
+        delete,
+        restore,
+    )

tests/fixtures/idp.py

@@ -624,7 +624,7 @@ def _ensure_groups_client_scope(client: KeycloakAdmin) -> None:
 
 def get_oidc_domain(signoz: types.SigNoz, admin_token: str) -> dict:
     response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=2,
     )
@@ -665,7 +665,7 @@ def perform_oidc_login(
 
 def get_saml_domain(signoz: types.SigNoz, admin_token: str) -> dict:
     response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=2,
     )

tests/fixtures/inframonitoring.py

@@ -48,22 +48,3 @@ def expected_status_counts(**nonzero: int) -> dict:
     counts = {bucket: 0 for bucket in STATUS_BUCKETS}
     counts.update(nonzero)
     return counts
-
-
-# All buckets of the clusters-API per-group resource counts (camelCase, matches
-# inframonitoringtypes ClusterRecord.Counts / the API response).
-RESOURCE_COUNT_BUCKETS = (
-    "nodes",
-    "namespaces",
-    "deployments",
-    "daemonSets",
-    "jobs",
-    "statefulSets",
-)
-
-
-def expected_resource_counts(**nonzero: int) -> dict:
-    """Full resource-counts dict with the given buckets set, rest 0."""
-    counts = {bucket: 0 for bucket in RESOURCE_COUNT_BUCKETS}
-    counts.update(nonzero)
-    return counts

tests/fixtures/signoz.py

@@ -11,7 +11,7 @@ import pytest
 import requests
 from testcontainers.core.container import DockerContainer, Network
 
-from fixtures import reuse, types
+from fixtures import reuse, tls, types
 from fixtures.logger import setup_logger
 
 logger = setup_logger(__name__)
@@ -115,6 +115,13 @@ def create_signoz(
                 "rw",
             )
 
+        # Trust the integration CA so tests can stand in for real TLS hosts
+        # (e.g. the fake accounts.google.com); SSL_CERT_FILE replaces the Go
+        # root pool, which is fine here since every other mocked upstream is
+        # plain http.
+        container.with_env("SSL_CERT_FILE", tls.CA_CONTAINER_PATH)
+        container.with_volume_mapping(str(tls.ensure_ca(pytestconfig) / "ca.pem"), tls.CA_CONTAINER_PATH, "ro")
+
         container.start()
 
         def ready(container: DockerContainer) -> None:

tests/fixtures/tls.py

@@ -0,0 +1,90 @@
+import datetime
+from pathlib import Path
+
+import pytest
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.serialization import pkcs12
+from cryptography.x509.oid import NameOID
+
+# The integration CA is mounted into every signoz container and trusted via
+# SSL_CERT_FILE (which replaces the Go root pool), so mocks that must be
+# reached over TLS under a real hostname (e.g. accounts.google.com) can serve
+# certificates issued by it. Material is persisted under .pytest_cache so
+# --reuse runs keep the chain the running containers already trust.
+CA_CONTAINER_PATH = "/etc/signoz-integration/ca.pem"
+KEYSTORE_PASSWORD = "password"  # noqa: S105
+
+
+def ensure_ca(pytestconfig: pytest.Config) -> Path:
+    """Directory holding the integration CA (ca.pem + ca.key), created once."""
+    ca_dir = pytestconfig.cache.mkdir("tls")
+    if (ca_dir / "ca.pem").exists() and (ca_dir / "ca.key").exists():
+        return ca_dir
+
+    now = datetime.datetime.now(datetime.UTC)
+    ca_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    ca_name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "signoz-integration-ca")])
+    ca_cert = (
+        x509.CertificateBuilder()
+        .subject_name(ca_name)
+        .issuer_name(ca_name)
+        .public_key(ca_key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now - datetime.timedelta(days=1))
+        .not_valid_after(now + datetime.timedelta(days=3650))
+        .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+        .sign(ca_key, hashes.SHA256())
+    )
+
+    (ca_dir / "ca.pem").write_bytes(ca_cert.public_bytes(serialization.Encoding.PEM))
+    (ca_dir / "ca.key").write_bytes(
+        ca_key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.PKCS8,
+            encryption_algorithm=serialization.NoEncryption(),
+        )
+    )
+
+    return ca_dir
+
+
+def ensure_server_keystore(pytestconfig: pytest.Config, hostname: str) -> Path:
+    """Directory holding a PKCS12 keystore (keystore.p12, password
+    KEYSTORE_PASSWORD) with a certificate for hostname issued by the
+    integration CA."""
+    ca_dir = ensure_ca(pytestconfig)
+    keystore_dir = pytestconfig.cache.mkdir(f"tls-{hostname}")
+    if (keystore_dir / "keystore.p12").exists():
+        return keystore_dir
+
+    ca_cert = x509.load_pem_x509_certificate((ca_dir / "ca.pem").read_bytes())
+    ca_key = serialization.load_pem_private_key((ca_dir / "ca.key").read_bytes(), password=None)
+
+    now = datetime.datetime.now(datetime.UTC)
+    leaf_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    leaf_cert = (
+        x509.CertificateBuilder()
+        .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, hostname)]))
+        .issuer_name(ca_cert.subject)
+        .public_key(leaf_key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now - datetime.timedelta(days=1))
+        .not_valid_after(now + datetime.timedelta(days=3650))
+        .add_extension(x509.SubjectAlternativeName([x509.DNSName(hostname)]), critical=False)
+        .add_extension(x509.ExtendedKeyUsage([x509.oid.ExtendedKeyUsageOID.SERVER_AUTH]), critical=False)
+        .sign(ca_key, hashes.SHA256())
+    )
+
+    (keystore_dir / "keystore.p12").write_bytes(
+        pkcs12.serialize_key_and_certificates(
+            name=hostname.encode(),
+            key=leaf_key,
+            cert=leaf_cert,
+            cas=[ca_cert],
+            encryption_algorithm=serialization.BestAvailableEncryption(KEYSTORE_PASSWORD.encode()),
+        )
+    )
+
+    return keystore_dir

tests/integration/testdata/inframonitoring/daemonsets_non_ds_pods.jsonl

@@ -88,15 +88,3 @@
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nd-ss-uid","k8s.pod.name":"nd-ss-pod","k8s.statefulset.name":"nd-ss","k8s.namespace.name":"ns-nd","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nd-ss-uid","k8s.pod.name":"nd-ss-pod","k8s.statefulset.name":"nd-ss","k8s.namespace.name":"ns-nd","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nd-ss-uid","k8s.pod.name":"nd-ss-pod","k8s.statefulset.name":"nd-ss","k8s.namespace.name":"ns-nd","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nd-ds-p1-uid", "k8s.pod.name": "nd-ds-p1", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nd-ds-p1-uid", "k8s.pod.name": "nd-ds-p1", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nd-ds-p1-uid", "k8s.pod.name": "nd-ds-p1", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "nd-ds-p1-clbo-uid", "k8s.pod.name": "nd-ds-p1-clbo", "k8s.daemonset.name": "nd-ds", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}

tests/integration/testdata/inframonitoring/jobs_non_job_pods.jsonl

@@ -94,15 +94,3 @@
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nj-ss-uid","k8s.pod.name":"nj-ss-pod","k8s.statefulset.name":"nj-ss","k8s.namespace.name":"ns-nj","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nj-ss-uid","k8s.pod.name":"nj-ss-pod","k8s.statefulset.name":"nj-ss","k8s.namespace.name":"ns-nj","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nj-ss-uid","k8s.pod.name":"nj-ss-pod","k8s.statefulset.name":"nj-ss","k8s.namespace.name":"ns-nj","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nj-job-p1-uid", "k8s.pod.name": "nj-job-p1", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nj-job-p1-uid", "k8s.pod.name": "nj-job-p1", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nj-job-p1-uid", "k8s.pod.name": "nj-job-p1", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "nj-job-p1-clbo-uid", "k8s.pod.name": "nj-job-p1-clbo", "k8s.job.name": "nj-job", "k8s.namespace.name": "ns-nj", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}

tests/integration/testdata/inframonitoring/namespaces_groupby.jsonl

@@ -1,36 +1,36 @@
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.deployment.name":"gb-dep-shared","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.deployment.name":"gb-dep-b3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.deployment.name":"gb-dep-b4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-1-uid","k8s.pod.name":"pod-gb-ns-1","k8s.namespace.name":"gb-ns-1","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-2-uid","k8s.pod.name":"pod-gb-ns-2","k8s.namespace.name":"gb-ns-2","k8s.cluster.name":"gb-cluster-a"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-3-uid","k8s.pod.name":"pod-gb-ns-3","k8s.namespace.name":"gb-ns-3","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.cpu.usage","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":0.5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.memory.working_set","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":100000000.0,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
+{"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"pod-gb-ns-4-uid","k8s.pod.name":"pod-gb-ns-4","k8s.namespace.name":"gb-ns-4","k8s.cluster.name":"gb-cluster-b"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}

tests/integration/testdata/inframonitoring/nodes_conditions.jsonl

@@ -31,48 +31,3 @@
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"carrier-pod-uid","k8s.pod.name":"carrier-pod","k8s.namespace.name":"carrier-ns","k8s.node.name":"carrier-phantom-host","k8s.cluster.name":"carrier-cluster"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"carrier-pod-uid","k8s.pod.name":"carrier-pod","k8s.namespace.name":"carrier-ns","k8s.node.name":"carrier-phantom-host","k8s.cluster.name":"carrier-cluster"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"carrier-pod-uid","k8s.pod.name":"carrier-pod","k8s.namespace.name":"carrier-ns","k8s.node.name":"carrier-phantom-host","k8s.cluster.name":"carrier-cluster"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.8, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.8, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.8, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n2", "k8s.node.uid": "ready-n2-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.3, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.3, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.3, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n3", "k8s.node.uid": "ready-n3-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.cpu.usage", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_cpu", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 4.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.memory.working_set", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.allocatable_memory", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 8000000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.node.condition_ready", "labels": {"k8s.node.name": "ready-n4", "k8s.node.uid": "ready-n4-uid", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}

tests/integration/testdata/inframonitoring/pods_phases.jsonl

@@ -145,63 +145,3 @@
 {"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "unk-p-uid", "k8s.pod.name": "unk-p", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "c-clbo"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 8, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
 {"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "unk-p-uid", "k8s.pod.name": "unk-p", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "c-clbo"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 8, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
 {"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "unk-p-uid", "k8s.pod.name": "unk-p", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "c-clbo"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 8, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu.usage", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.7, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu.usage", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.7, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu.usage", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.7, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_request_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_request_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_request_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_limit_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_limit_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_limit_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory.working_set", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 100000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory.working_set", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 100000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory.working_set", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 100000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_request_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_request_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_request_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_limit_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_limit_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_limit_utilization", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "clbo-a-uid", "k8s.pod.name": "clbo-a", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu.usage", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.3, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu.usage", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.3, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu.usage", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.3, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_request_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_request_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_request_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_limit_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_limit_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.cpu_limit_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory.working_set", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 100000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory.working_set", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 100000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory.working_set", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 100000000.0, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_request_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_request_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_request_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_limit_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_limit_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.memory_limit_utilization", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 0.5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.restarts", "labels": {"k8s.pod.uid": "clbo-b-uid", "k8s.pod.name": "clbo-b", "k8s.namespace.name": "ns-x", "k8s.node.name": "node-a", "k8s.deployment.name": "phase-test", "k8s.cluster.name": "cluster-x", "k8s.statefulset.name": "", "k8s.daemonset.name": "", "k8s.job.name": "", "k8s.cronjob.name": "", "k8s.pod.start_time": "__START_TIME__", "k8s.container.name": "app"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 5, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}

tests/integration/testdata/inframonitoring/statefulsets_non_ss_pods.jsonl

@@ -67,15 +67,3 @@
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nd-dep-uid","k8s.pod.name":"nd-dep-pod","k8s.deployment.name":"nd-dep","k8s.namespace.name":"ns-nd","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:00:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nd-dep-uid","k8s.pod.name":"nd-dep-pod","k8s.deployment.name":"nd-dep","k8s.namespace.name":"ns-nd","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:02:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
 {"metric_name":"k8s.pod.phase","labels":{"k8s.pod.uid":"nd-dep-uid","k8s.pod.name":"nd-dep-pod","k8s.deployment.name":"nd-dep","k8s.namespace.name":"ns-nd","k8s.cluster.name":"cluster-x"},"timestamp":"2025-01-10T10:04:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "ns-ss-p1-uid", "k8s.pod.name": "ns-ss-p1", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:00:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "ns-ss-p1-uid", "k8s.pod.name": "ns-ss-p1", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:02:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "ns-ss-p1-uid", "k8s.pod.name": "ns-ss-p1", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.phase", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 2, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.pod.status_reason", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 6, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}
-{"metric_name": "k8s.container.status.reason", "labels": {"k8s.pod.uid": "ns-ss-p1-clbo-uid", "k8s.pod.name": "ns-ss-p1-clbo", "k8s.statefulset.name": "ns-ss", "k8s.namespace.name": "ns-nd", "k8s.cluster.name": "cluster-x", "k8s.container.name": "app", "k8s.container.status.reason": "CrashLoopBackOff"}, "timestamp": "2025-01-10T10:04:00+00:00", "value": 1, "temporality": "Unspecified", "type_": "Gauge", "is_monotonic": false}

tests/integration/tests/basepath/01_oidc.py

@@ -50,13 +50,13 @@ def test_create_auth_domain(
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/signoz/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/signoz/api/v2/auth_domains"),
         json={
             "name": "oidc.basepath.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "oidc",
-                "oidcConfig": {
+                "kind": "oidc",
+                "spec": {
                     "clientId": settings["client_id"],
                     "clientSecret": settings["client_secret"],
                     # Change the hostname of the issuer to the internal resolvable hostname of the idp

tests/integration/tests/basepath/02_saml.py

@@ -48,16 +48,16 @@ def test_create_auth_domain(
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/signoz/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/signoz/api/v2/auth_domains"),
         json={
             "name": "saml.basepath.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": settings["entityID"],
-                    "samlIdp": settings["singleSignOnServiceLocation"],
-                    "samlCert": settings["certificate"],
+                "kind": "saml",
+                "spec": {
+                    "entityId": settings["entityID"],
+                    "location": settings["singleSignOnServiceLocation"],
+                    "certificate": settings["certificate"],
                 },
             },
         },

tests/integration/tests/callbackauthn/01_domain.py

@@ -1,6 +1,7 @@
 from collections.abc import Callable
 from http import HTTPStatus
 
+import pytest
 import requests
 
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
@@ -14,27 +15,33 @@ def test_create_and_get_domain(
 ):
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    # Get domains which should be an empty list
+    # Reruns against a reused stack find domains from previous runs; drop them
+    # all so the suite starts from a clean slate.
     response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=2,
     )
 
     assert response.status_code == HTTPStatus.OK
     assert response.json()["status"] == "success"
-    data = response.json()["data"]
-    assert len(data) == 0
+    for domain in response.json()["data"]:
+        response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=2,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT
 
     # Create a domain with google auth config
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "domain-google.integration.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "google_auth",
-                "googleAuthConfig": {
+                "kind": "google",
+                "spec": {
                     "clientId": "client-id",
                     "clientSecret": "client-secret",
                     "redirectURI": "redirect-uri",
@@ -49,16 +56,16 @@ def test_create_and_get_domain(
 
     # Create a domain with saml config
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "domain-saml.integration.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                 },
             },
         },
@@ -70,7 +77,7 @@ def test_create_and_get_domain(
 
     # List the domains
     response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=2,
     )
@@ -86,7 +93,7 @@ def test_create_and_get_domain(
             "domain-google.integration.test",
             "domain-saml.integration.test",
         ]
-        assert domain["config"]["ssoType"] in ["google_auth", "saml"]
+        assert domain["config"]["kind"] in ["google", "saml"]
 
 
 def test_create_invalid(
@@ -96,15 +103,15 @@ def test_create_invalid(
 ):
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    # Create a domain with type saml and body for oidc, this should fail because oidcConfig is not allowed for saml
+    # Create a domain with kind saml and a spec for oidc, this should fail because the spec does not match the kind
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "domain.integration.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "oidcConfig": {
+                "kind": "saml",
+                "spec": {
                     "clientId": "client-id",
                     "clientSecret": "client-secret",
                     "issuer": "issuer",
@@ -117,18 +124,34 @@ def test_create_invalid(
 
     assert response.status_code == HTTPStatus.BAD_REQUEST
 
+    # Create a domain with a kind but no spec
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": "domain.integration.test",
+            "enabled": True,
+            "config": {
+                "kind": "saml",
+            },
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+
     # Create a domain with invalid name
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "$%^invalid",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                 },
             },
         },
@@ -140,17 +163,17 @@ def test_create_invalid(
 
     # Create a domain with no name
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                 },
-            }
+            },
         },
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=2,
@@ -160,7 +183,7 @@ def test_create_invalid(
 
     # Create a domain with no config
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "domain.integration.test",
         },
@@ -180,21 +203,21 @@ def test_create_invalid_role_mapping(
 
     # Create domain with invalid defaultRole
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "invalid-role-test.integration.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
-                },
-                "roleMapping": {
-                    "defaultRole": "SUPERADMIN",  # Invalid role
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                 },
             },
+            "roleMapping": {
+                "defaultRole": "SUPERADMIN",  # Invalid role
+            },
         },
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=2,
@@ -204,22 +227,22 @@ def test_create_invalid_role_mapping(
 
     # Create domain with invalid role in groupMappings
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "invalid-group-role.integration.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                 },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "admins": "SUPERUSER",  # Invalid role
-                    },
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "admins": "SUPERUSER",  # Invalid role
                 },
             },
         },
@@ -231,23 +254,23 @@ def test_create_invalid_role_mapping(
 
     # Valid role mapping should succeed
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "valid-role-mapping.integration.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": "saml-entity",
-                    "samlIdp": "saml-idp",
-                    "samlCert": "saml-cert",
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "saml-idp",
+                    "certificate": "saml-cert",
                 },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                    },
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
                 },
             },
         },
@@ -256,3 +279,288 @@ def test_create_invalid_role_mapping(
     )
 
     assert response.status_code == HTTPStatus.CREATED
+
+
+@pytest.mark.parametrize(
+    ("config", "role_mapping", "expected_config", "expected_role_mapping"),
+    [
+        pytest.param(
+            {
+                "kind": "google",
+                "spec": {"clientId": "client-id", "clientSecret": "client-secret"},
+            },
+            None,
+            {
+                "kind": "google",
+                "spec": {
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "redirectURI": "",
+                    "fetchGroups": False,
+                    "insecureSkipEmailVerified": False,
+                },
+            },
+            None,
+            id="google_minimal",
+        ),
+        pytest.param(
+            {
+                "kind": "google",
+                "spec": {
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "redirectURI": "https://redirect.integration.test",
+                    "fetchGroups": True,
+                    "serviceAccountJson": '{"type": "service_account"}',
+                    "domainToAdminEmail": {
+                        "roundtrip.integration.test": "admin@roundtrip.integration.test",
+                        "*": "fallback@roundtrip.integration.test",
+                    },
+                    "fetchTransitiveGroupMembership": True,
+                    "allowedGroups": ["group-one", "group-two"],
+                    "insecureSkipEmailVerified": True,
+                },
+            },
+            None,
+            {
+                "kind": "google",
+                "spec": {
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "redirectURI": "https://redirect.integration.test",
+                    "fetchGroups": True,
+                    "serviceAccountJson": '{"type": "service_account"}',
+                    "domainToAdminEmail": {
+                        "roundtrip.integration.test": "admin@roundtrip.integration.test",
+                        "*": "fallback@roundtrip.integration.test",
+                    },
+                    "fetchTransitiveGroupMembership": True,
+                    "allowedGroups": ["group-one", "group-two"],
+                    "insecureSkipEmailVerified": True,
+                },
+            },
+            None,
+            id="google_full",
+        ),
+        pytest.param(
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                },
+            },
+            None,
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": False,
+                    "attributeMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+                },
+            },
+            None,
+            id="saml_minimal",
+        ),
+        pytest.param(
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": True,
+                    "attributeMapping": {"email": "mail"},
+                },
+            },
+            None,
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": True,
+                    "attributeMapping": {"email": "mail", "name": "name", "groups": "groups", "role": "role"},
+                },
+            },
+            None,
+            id="saml_partial_attribute_mapping",
+        ),
+        pytest.param(
+            {
+                "kind": "oidc",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                },
+            },
+            None,
+            {
+                "kind": "oidc",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "issuerAlias": "",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "claimMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+                    "insecureSkipEmailVerified": False,
+                    "getUserInfo": False,
+                },
+            },
+            None,
+            id="oidc_minimal",
+        ),
+        pytest.param(
+            {
+                "kind": "oidc",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "issuerAlias": "https://alias.integration.test",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "claimMapping": {"email": "eml", "name": "nm", "groups": "grps", "role": "rl"},
+                    "insecureSkipEmailVerified": True,
+                    "getUserInfo": True,
+                },
+            },
+            None,
+            {
+                "kind": "oidc",
+                "spec": {
+                    "issuer": "https://issuer.integration.test",
+                    "issuerAlias": "https://alias.integration.test",
+                    "clientId": "client-id",
+                    "clientSecret": "client-secret",
+                    "claimMapping": {"email": "eml", "name": "nm", "groups": "grps", "role": "rl"},
+                    "insecureSkipEmailVerified": True,
+                    "getUserInfo": True,
+                },
+            },
+            None,
+            id="oidc_full",
+        ),
+        pytest.param(
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                },
+            },
+            {
+                "defaultRole": "EDITOR",
+                "groupMappings": {"platform-team": "ADMIN"},
+                "useRoleAttribute": False,
+            },
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": False,
+                    "attributeMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+                },
+            },
+            {
+                "defaultRole": "signoz-editor",
+                "groupMappings": {"platform-team": "signoz-admin"},
+                "useRoleAttribute": False,
+            },
+            id="role_mapping_names_normalized",
+        ),
+        pytest.param(
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                },
+            },
+            {"defaultRole": "VIEWER", "useRoleAttribute": True},
+            {
+                "kind": "saml",
+                "spec": {
+                    "entityId": "saml-entity",
+                    "location": "https://idp.integration.test/sso",
+                    "certificate": "saml-cert",
+                    "insecureSkipAuthNRequestsSigned": False,
+                    "attributeMapping": {"email": "email", "name": "name", "groups": "groups", "role": "role"},
+                },
+            },
+            {"defaultRole": "signoz-viewer", "groupMappings": None, "useRoleAttribute": True},
+            id="role_mapping_null_group_mappings",
+        ),
+    ],
+)
+def test_domain_roundtrip(  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    config: dict,
+    role_mapping: dict | None,
+    expected_config: dict,
+    expected_role_mapping: dict | None,
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Drop a same-named leftover so reruns against a reused stack stay green.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    for domain in response.json()["data"]:
+        if domain["name"] == "roundtrip.integration.test":
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=2,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": "roundtrip.integration.test",
+            "enabled": True,
+            "config": config,
+            "roleMapping": role_mapping,
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.CREATED
+    domain_id = response.json()["data"]["id"]
+
+    # Clients (e.g. the terraform provider) read state back with a follow-up
+    # GET after every write, so posted values must round-trip exactly; the
+    # server-side defaulting and role-name normalization pinned here are part
+    # of that contract.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()["data"]
+
+    assert data["name"] == "roundtrip.integration.test"
+    assert data["enabled"] is True
+    assert data["config"] == expected_config
+    assert data["roleMapping"] == expected_role_mapping
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT

tests/integration/tests/callbackauthn/02_saml.py

@@ -50,16 +50,16 @@ def test_create_auth_domain(
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "saml.integration.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": settings["entityID"],
-                    "samlIdp": settings["singleSignOnServiceLocation"],
-                    "samlCert": settings["certificate"],
+                "kind": "saml",
+                "spec": {
+                    "entityId": settings["entityID"],
+                    "location": settings["singleSignOnServiceLocation"],
+                    "certificate": settings["certificate"],
                 },
             },
         },
@@ -71,7 +71,7 @@ def test_create_auth_domain(
 
     # Get the domains from signoz
     response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=2,
     )
@@ -174,30 +174,30 @@ def test_saml_update_domain_with_group_mappings(
 
     # update the existing saml domain to have role mappings also
     response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
         json={
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": settings["entityID"],
-                    "samlIdp": settings["singleSignOnServiceLocation"],
-                    "samlCert": settings["certificate"],
+                "kind": "saml",
+                "spec": {
+                    "entityId": settings["entityID"],
+                    "location": settings["singleSignOnServiceLocation"],
+                    "certificate": settings["certificate"],
                     "attributeMapping": {
                         "name": "givenName",
                         "groups": "groups",
                         "role": "signoz_role",
                     },
                 },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                        "signoz-viewers": "VIEWER",
-                    },
-                    "useRoleAttribute": False,
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
+                    "signoz-viewers": "VIEWER",
                 },
+                "useRoleAttribute": False,
             },
         },
         headers={"Authorization": f"Bearer {admin_token}"},
@@ -329,29 +329,29 @@ def test_saml_update_domain_with_use_role_claim(
     settings = get_saml_settings()
 
     response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
         json={
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "saml",
-                "samlConfig": {
-                    "samlEntity": settings["entityID"],
-                    "samlIdp": settings["singleSignOnServiceLocation"],
-                    "samlCert": settings["certificate"],
+                "kind": "saml",
+                "spec": {
+                    "entityId": settings["entityID"],
+                    "location": settings["singleSignOnServiceLocation"],
+                    "certificate": settings["certificate"],
                     "attributeMapping": {
                         "name": "displayName",
                         "groups": "groups",
                         "role": "signoz_role",
                     },
                 },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                    },
-                    "useRoleAttribute": True,
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
                 },
+                "useRoleAttribute": True,
             },
         },
         headers={"Authorization": f"Bearer {admin_token}"},

tests/integration/tests/callbackauthn/03_oidc.py

@@ -48,13 +48,13 @@ def test_create_auth_domain(
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
         json={
             "name": "oidc.integration.test",
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "oidc",
-                "oidcConfig": {
+                "kind": "oidc",
+                "spec": {
                     "clientId": settings["client_id"],
                     "clientSecret": settings["client_secret"],
                     # Change the hostname of the issuer to the internal resolvable hostname of the idp
@@ -121,12 +121,12 @@ def test_oidc_update_domain_with_group_mappings(
     settings = get_oidc_settings(client_id)
 
     response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
         json={
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "oidc",
-                "oidcConfig": {
+                "kind": "oidc",
+                "spec": {
                     "clientId": settings["client_id"],
                     "clientSecret": settings["client_secret"],
                     "issuer": f"{idp.container.container_configs['6060'].get(urlparse(settings['issuer']).path)}",
@@ -139,15 +139,15 @@ def test_oidc_update_domain_with_group_mappings(
                         "role": "signoz_role",
                     },
                 },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                        "signoz-viewers": "VIEWER",
-                    },
-                    "useRoleAttribute": False,
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
+                    "signoz-viewers": "VIEWER",
                 },
+                "useRoleAttribute": False,
             },
         },
         headers={"Authorization": f"Bearer {admin_token}"},
@@ -278,12 +278,12 @@ def test_oidc_update_domain_with_use_role_claim(
     settings = get_oidc_settings(client_id)
 
     response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/domains/{domain['id']}"),
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
         json={
+            "enabled": True,
             "config": {
-                "ssoEnabled": True,
-                "ssoType": "oidc",
-                "oidcConfig": {
+                "kind": "oidc",
+                "spec": {
                     "clientId": settings["client_id"],
                     "clientSecret": settings["client_secret"],
                     "issuer": f"{idp.container.container_configs['6060'].get(urlparse(settings['issuer']).path)}",
@@ -296,14 +296,14 @@ def test_oidc_update_domain_with_use_role_claim(
                         "role": "signoz_role",
                     },
                 },
-                "roleMapping": {
-                    "defaultRole": "VIEWER",
-                    "groupMappings": {
-                        "signoz-admins": "ADMIN",
-                        "signoz-editors": "EDITOR",
-                    },
-                    "useRoleAttribute": True,
+            },
+            "roleMapping": {
+                "defaultRole": "VIEWER",
+                "groupMappings": {
+                    "signoz-admins": "ADMIN",
+                    "signoz-editors": "EDITOR",
                 },
+                "useRoleAttribute": True,
             },
         },
         headers={"Authorization": f"Bearer {admin_token}"},

tests/integration/tests/callbackauthn/04_google.py

@@ -0,0 +1,205 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    assert_user_has_role,
+    find_user_with_roles_by_email,
+)
+from fixtures.googleidp import google_oidc_mappings, perform_google_login
+from fixtures.types import Operation, SigNoz
+
+GOOGLE_DOMAIN = "google.integration.test"
+GOOGLE_CLIENT_ID = "google-client-id.apps.googleusercontent.com"
+GOOGLE_CLIENT_SECRET = "google-client-secret"
+
+
+def test_create_auth_domain(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Reruns against a reused stack find the domain from the previous run;
+    # drop it so creation always starts from a clean slate.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    for domain in response.json()["data"]:
+        if domain["name"] == GOOGLE_DOMAIN:
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=2,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": GOOGLE_DOMAIN,
+            "enabled": True,
+            "config": {
+                "kind": "google",
+                "spec": {
+                    "clientId": GOOGLE_CLIENT_ID,
+                    "clientSecret": GOOGLE_CLIENT_SECRET,
+                },
+            },
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+
+    assert response.status_code == HTTPStatus.CREATED
+
+
+def test_google_authn(
+    signoz: SigNoz,
+    googleidp: types.TestContainerDocker,
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    get_session_context: Callable[[str], dict],
+) -> None:
+    email = "viewer@google.integration.test"
+    make_http_mocks(googleidp, google_oidc_mappings(email=email, name="Google Viewer", hd=GOOGLE_DOMAIN, audience=GOOGLE_CLIENT_ID))
+
+    redirect_url = perform_google_login(signoz, googleidp, get_session_context, email)
+    assert "accessToken=" in redirect_url
+
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    found_user = find_user_with_roles_by_email(signoz, admin_token, email)
+
+    assert found_user["displayName"] == "Google Viewer"
+    assert_user_has_role(found_user, "signoz-viewer")
+
+
+def test_google_authn_hd_mismatch(
+    signoz: SigNoz,
+    googleidp: types.TestContainerDocker,
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    get_session_context: Callable[[str], dict],
+) -> None:
+    # The id_token carries a hosted-domain claim for a different workspace than
+    # the auth domain; the callback must reject it and provision no user.
+    email = "intruder@google.integration.test"
+    make_http_mocks(googleidp, google_oidc_mappings(email=email, name="Intruder", hd="other.workspace.test", audience=GOOGLE_CLIENT_ID))
+
+    redirect_url = perform_google_login(signoz, googleidp, get_session_context, email)
+    assert "callbackauthnerr" in redirect_url
+    assert "accessToken=" not in redirect_url
+
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert not any(user["email"] == email for user in response.json()["data"])
+
+
+def test_google_authn_unverified_email(
+    signoz: SigNoz,
+    googleidp: types.TestContainerDocker,
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    get_session_context: Callable[[str], dict],
+) -> None:
+    email = "unverified@google.integration.test"
+    make_http_mocks(googleidp, google_oidc_mappings(email=email, name="Unverified", hd=GOOGLE_DOMAIN, audience=GOOGLE_CLIENT_ID, email_verified=False))
+
+    redirect_url = perform_google_login(signoz, googleidp, get_session_context, email)
+    assert "callbackauthnerr" in redirect_url
+
+    # Opting the domain into insecureSkipEmailVerified must let the same
+    # unverified identity through.
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    domain = next(domain for domain in response.json()["data"] if domain["name"] == GOOGLE_DOMAIN)
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
+        json={
+            "enabled": True,
+            "config": {
+                "kind": "google",
+                "spec": {
+                    "clientId": GOOGLE_CLIENT_ID,
+                    "clientSecret": GOOGLE_CLIENT_SECRET,
+                    "insecureSkipEmailVerified": True,
+                },
+            },
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    redirect_url = perform_google_login(signoz, googleidp, get_session_context, email)
+    assert "accessToken=" in redirect_url
+
+    found_user = find_user_with_roles_by_email(signoz, admin_token, email)
+    assert_user_has_role(found_user, "signoz-viewer")
+
+
+def test_google_role_mapping_default_role(
+    signoz: SigNoz,
+    googleidp: types.TestContainerDocker,
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    get_session_context: Callable[[str], dict],
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.OK
+    domain = next(domain for domain in response.json()["data"] if domain["name"] == GOOGLE_DOMAIN)
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain['id']}"),
+        json={
+            "enabled": True,
+            "config": {
+                "kind": "google",
+                "spec": {
+                    "clientId": GOOGLE_CLIENT_ID,
+                    "clientSecret": GOOGLE_CLIENT_SECRET,
+                },
+            },
+            "roleMapping": {
+                "defaultRole": "EDITOR",
+            },
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    email = "editor@google.integration.test"
+    make_http_mocks(googleidp, google_oidc_mappings(email=email, name="Google Editor", hd=GOOGLE_DOMAIN, audience=GOOGLE_CLIENT_ID))
+
+    redirect_url = perform_google_login(signoz, googleidp, get_session_context, email)
+    assert "accessToken=" in redirect_url
+
+    found_user = find_user_with_roles_by_email(signoz, admin_token, email)
+    assert_user_has_role(found_user, "signoz-editor")

tests/integration/tests/inframonitoring/02_pods.py

@@ -8,11 +8,7 @@ import requests
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.fs import get_testdata_file_path
-from fixtures.inframonitoring import (
-    STATUS_BUCKETS,
-    STATUS_TO_BUCKET,
-    expected_status_counts,
-)
+from fixtures.inframonitoring import STATUS_BUCKETS, STATUS_TO_BUCKET
 from fixtures.metrics import Metrics
 from fixtures.querier import compare_values, get_all_warnings
 
@@ -455,95 +451,6 @@ def test_pods_pagination(
     assert set(seen_pods) == {f"page-p{i}" for i in range(1, K + 1)}
 
 
-def test_pods_filter_pagination_and_ordering(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token,
-    insert_metrics,
-) -> None:
-    """filterByPodStatus composed with pagination + name ordering. The full-scope
-    status keyset is resolved before slicing, so total reflects the full matched
-    set and pages stay disjoint + complete on both the metric-ordering branch
-    (paginateWithBackfill) and the name-ordering branch (PaginateMetadataByName).
-    crashloopbackoff matches 4 pods in pods_phases.jsonl: clbo-a, clbo-b, run-p, unk-p."""
-    now = datetime.now(tz=UTC).replace(microsecond=0)
-    insert_metrics(
-        _load_pods_metrics(
-            "inframonitoring/pods_phases.jsonl",
-            base_time=now - timedelta(minutes=4),
-        )
-    )
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    start = int((now - timedelta(minutes=5)).timestamp() * 1000)
-    end = int(now.timestamp() * 1000)
-    matched = {"clbo-a", "clbo-b", "run-p", "unk-p"}
-
-    # Metric-ordering branch (default cpu order): total is invariant across a paged
-    # walk and the pages are disjoint + cover the full matched set.
-    seen: list[str] = []
-    totals: set[int] = set()
-    for offset in (0, 2, 4):
-        resp = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": start,
-                "end": end,
-                "limit": 2,
-                "offset": offset,
-                "filter": {"filterByPodStatus": ["crashloopbackoff"]},
-            },
-            timeout=5,
-        )
-        assert resp.status_code == HTTPStatus.OK, resp.text
-        data = resp.json()["data"]
-        totals.add(data["total"])
-        assert len(data["records"]) == max(0, min(2, 4 - offset)), f"offset={offset}: {data['records']!r}"
-        seen.extend(r["meta"]["k8s.pod.name"] for r in data["records"])
-    assert totals == {4}, f"total not invariant under filter+pagination: {totals}"
-    assert len(seen) == 4, f"pages overlapped: {seen}"
-    assert set(seen) == matched
-
-    # Name-ordering branch (orderBy k8s.pod.name asc, groupBy empty): the filtered
-    # set is returned in name order; total is the full matched count.
-    ordered = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": start,
-            "end": end,
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["crashloopbackoff"]},
-            "orderBy": {"key": {"name": "k8s.pod.name"}, "direction": "asc"},
-        },
-        timeout=5,
-    )
-    assert ordered.status_code == HTTPStatus.OK, ordered.text
-    odata = ordered.json()["data"]
-    assert odata["total"] == 4
-    assert [r["meta"]["k8s.pod.name"] for r in odata["records"]] == ["clbo-a", "clbo-b", "run-p", "unk-p"]
-
-    # Second page of the name branch: PaginateMetadataByName slices the filtered set
-    # correctly (offset past the first 2 matched -> the last 2), total unchanged.
-    page2 = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": start,
-            "end": end,
-            "limit": 2,
-            "offset": 2,
-            "filter": {"filterByPodStatus": ["crashloopbackoff"]},
-            "orderBy": {"key": {"name": "k8s.pod.name"}, "direction": "asc"},
-        },
-        timeout=5,
-    )
-    assert page2.status_code == HTTPStatus.OK, page2.text
-    p2 = page2.json()["data"]
-    assert p2["total"] == 4
-    assert [r["meta"]["k8s.pod.name"] for r in p2["records"]] == ["run-p", "unk-p"]
-
-
 # orderBy keys per pods_constants.go:42-48 (snake_case request keys, camelCase
 # response fields). k8s.pod.name sorts via the metadata-name branch
 # (PaginateMetadataByName) and is only allowed when groupBy is empty.
@@ -646,16 +553,6 @@ def test_pods_orderby(  # pylint: disable=too-many-arguments,too-many-positional
             "is only allowed when groupBy is empty",
             id="orderby_podname_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid",
-        ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["running", "Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid_member",
-        ),
     ],
 )
 def test_pods_validation_errors(
@@ -761,44 +658,6 @@ def test_pods_status_list_mode(
         if other != bucket:
             assert rec["podCountsByStatus"][other] == 0, f"expected {other}=0 when status={expected_status}, got {rec['podCountsByStatus']}"
 
-    # filterByPodStatus (secondary filter, applied after status is assigned):
-    # a set containing the pod's status keeps it; a set without it filters it
-    # out. Wire value is case-insensitive (valuer lowercases). Multi-select is
-    # OR: [own_status, other] still keeps the pod.
-    for variant in ([expected_status], [expected_status.upper()], [expected_status, "running"]):
-        matched = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"expression": f"k8s.pod.name = '{pod_name}'", "filterByPodStatus": variant},
-            },
-            timeout=5,
-        )
-        assert matched.status_code == HTTPStatus.OK, matched.text
-        mdata = matched.json()["data"]
-        assert mdata["total"] == 1, f"filterByPodStatus={variant!r} should keep {pod_name}"
-        assert mdata["records"][0]["podCountsByStatus"][bucket] == 1
-
-    # None of the seeded pods resolves to Running or OOMKilled -> reliable
-    # mismatches, as a single value and as an all-absent multi-select set.
-    for fbps in (["running"], ["running", "oomKilled"]):
-        filtered_out = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"expression": f"k8s.pod.name = '{pod_name}'", "filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert filtered_out.status_code == HTTPStatus.OK, filtered_out.text
-        assert filtered_out.json()["data"]["total"] == 0, f"{pod_name} must be filtered out by filterByPodStatus={fbps!r}"
-
 
 @pytest.mark.parametrize(
     "pod_name,expected_restarts",
@@ -979,61 +838,6 @@ def test_pods_status_grouped_mode(
     )
     assert rec["podCountsByStatus"] == expected_counts
 
-    # filterByPodStatus in grouped mode: the group is kept because >=1 pod
-    # matches, and only the filtered buckets are populated (others zeroed).
-    running = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "groupBy": [{"name": "k8s.namespace.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "filter": {"filterByPodStatus": ["running"]},
-        },
-        timeout=5,
-    )
-    assert running.status_code == HTTPStatus.OK, running.text
-    rdata = running.json()["data"]
-    assert rdata["total"] == 1
-    assert rdata["records"][0]["podCountsByStatus"] == expected_status_counts(running=2)
-
-    # Multi-select is OR: both requested buckets populated (union), others zeroed.
-    multi = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "groupBy": [{"name": "k8s.namespace.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "filter": {"filterByPodStatus": ["running", "crashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert multi.status_code == HTTPStatus.OK, multi.text
-    mdata = multi.json()["data"]
-    assert mdata["total"] == 1
-    assert mdata["records"][0]["podCountsByStatus"] == expected_status_counts(running=2, crashLoopBackOff=1)
-
-    # A set fully absent from the group -> group dropped, empty page (single
-    # and multi-select both).
-    for fbps in (["oomKilled"], ["oomKilled", "unknown"]):
-        absent = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "groupBy": [{"name": "k8s.namespace.name", "fieldDataType": "string", "fieldContext": "resource"}],
-                "filter": {"filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert absent.status_code == HTTPStatus.OK, absent.text
-        assert absent.json()["data"]["total"] == 0, f"group must be dropped by filterByPodStatus={fbps!r}"
-
 
 def test_pods_restarts_grouped_mode(
     signoz: types.SigNoz,
@@ -1123,25 +927,3 @@ def test_pods_status_missing_metric_warning(
     for bucket in STATUS_BUCKETS:
         assert rec["podCountsByStatus"][bucket] == 0, f"expected {bucket}=0 when gated off, got {rec['podCountsByStatus']}"
     assert rec["podRestarts"] == -1
-
-    # filterByPodStatus + missing status metric: the up-front gate surfaces the
-    # warning and returns an empty page (Total 0) instead of silently filtering
-    # everything out.
-    filtered = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.pod.name = 'miss-p1'", "filterByPodStatus": ["running"]},
-        },
-        timeout=5,
-    )
-    assert filtered.status_code == HTTPStatus.OK, filtered.text
-    fdata = filtered.json()["data"]
-    assert fdata["total"] == 0
-    assert fdata["records"] == []
-    fwarn = fdata.get("warning") or {}
-    fmsgs = ([fwarn["message"]] if fwarn.get("message") else []) + [w["message"] for w in fwarn.get("warnings", [])]
-    assert any("Pod status could not be computed" in m for m in fmsgs), f"gate warning missing on filtered call: {fmsgs!r}"

tests/integration/tests/inframonitoring/03_nodes.py

@@ -8,7 +8,6 @@ import requests
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.fs import get_testdata_file_path
-from fixtures.inframonitoring import expected_status_counts
 from fixtures.metrics import Metrics
 from fixtures.querier import compare_values, get_all_warnings
 
@@ -311,115 +310,6 @@ def test_nodes_filter_invalid(
         assert any(err_substr in e["message"] for e in body["error"]["errors"]), f"{err_substr!r} not surfaced: {body['error']['errors']!r}"
 
 
-def test_nodes_filter_by_pod_status(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token,
-    insert_metrics,
-) -> None:
-    """filterByPodStatus on nodes: a node is kept when >=1 of its pods matches
-    the requested display status, and podCountsByStatus reflects only that
-    status (others 0); an absent status yields an empty page. Reuses
-    clusters_pod_phases.jsonl (carries k8s.node.name + full status metrics):
-    pp-node has running=3, crashLoopBackOff=1, error=1, evicted=1, pending=1."""
-    now = datetime.now(tz=UTC).replace(microsecond=0)
-    insert_metrics(
-        Metrics.load_from_file(
-            get_testdata_file_path("inframonitoring/clusters_pod_phases.jsonl"),
-            base_time=now - timedelta(minutes=4),
-        )
-    )
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # Multi-select is OR -> the union of requested buckets (others zeroed).
-    for fbps, expected in (
-        (["running"], expected_status_counts(running=3)),
-        (["CrashLoopBackOff"], expected_status_counts(crashLoopBackOff=1)),
-        (["running", "CrashLoopBackOff"], expected_status_counts(running=3, crashLoopBackOff=1)),
-    ):
-        resp = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert resp.status_code == HTTPStatus.OK, resp.text
-        data = resp.json()["data"]
-        assert data["total"] == 1
-        rec = data["records"][0]
-        assert rec["nodeName"] == "pp-node"
-        assert rec["podCountsByStatus"] == expected
-
-    # A set fully absent from the node -> empty page (single and multi).
-    for fbps in (["completed"], ["completed", "oomKilled"]):
-        absent = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert absent.status_code == HTTPStatus.OK, absent.text
-        assert absent.json()["data"]["total"] == 0, f"node must be dropped by filterByPodStatus={fbps!r}"
-
-    # Combined filterByPodStatus + filterByNodeReadiness = AND. pp-node is Ready
-    # and runs pods -> kept when both match; dropped if either side has no match.
-    both_match = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["running"], "filterByNodeReadiness": ["ready"]},
-        },
-        timeout=5,
-    )
-    assert both_match.status_code == HTTPStatus.OK, both_match.text
-    bdata = both_match.json()["data"]
-    assert bdata["total"] == 1
-    assert bdata["records"][0]["nodeName"] == "pp-node"
-
-    # readiness side fails (pp-node is not not_ready) -> dropped.
-    readiness_fails = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["running"], "filterByNodeReadiness": ["not_ready"]},
-        },
-        timeout=5,
-    )
-    assert readiness_fails.status_code == HTTPStatus.OK, readiness_fails.text
-    assert readiness_fails.json()["data"]["total"] == 0
-
-    # pod-status side fails (no completed pod) -> dropped.
-    status_fails = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["completed"], "filterByNodeReadiness": ["ready"]},
-        },
-        timeout=5,
-    )
-    assert status_fails.status_code == HTTPStatus.OK, status_fails.text
-    assert status_fails.json()["data"]["total"] == 0
-
-
 @pytest.mark.parametrize(
     "node_name,expected_condition",
     [
@@ -468,56 +358,6 @@ def test_nodes_condition_list_mode(
     else:
         assert rec["nodeCountsByReadiness"] == {"ready": 0, "notReady": 1}
 
-    # filterByNodeReadiness (secondary filter): matching readiness keeps the node,
-    # the opposite readiness filters it out.
-    matched = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": f"k8s.node.name = '{node_name}'", "filterByNodeReadiness": [expected_condition]},
-        },
-        timeout=5,
-    )
-    assert matched.status_code == HTTPStatus.OK, matched.text
-    mdata = matched.json()["data"]
-    assert mdata["total"] == 1
-    assert mdata["records"][0]["nodeName"] == node_name
-
-    opposite = "not_ready" if expected_condition == "ready" else "ready"
-
-    # Multi-select is OR: a set containing the node's condition keeps it even
-    # alongside the opposite readiness.
-    or_keep = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": f"k8s.node.name = '{node_name}'", "filterByNodeReadiness": [expected_condition, opposite]},
-        },
-        timeout=5,
-    )
-    assert or_keep.status_code == HTTPStatus.OK, or_keep.text
-    assert or_keep.json()["data"]["total"] == 1, f"multi-select should keep {node_name}"
-
-    dropped = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": f"k8s.node.name = '{node_name}'", "filterByNodeReadiness": [opposite]},
-        },
-        timeout=5,
-    )
-    assert dropped.status_code == HTTPStatus.OK, dropped.text
-    assert dropped.json()["data"]["total"] == 0
-
 
 def test_nodes_condition_latest_wins(
     signoz: types.SigNoz,
@@ -609,60 +449,6 @@ def test_nodes_condition_grouped_mode(
     # meta surfaces the groupBy key.
     assert rec["meta"].get("k8s.cluster.name") == "cluster-mixed"
 
-    # filterByNodeReadiness in grouped mode: the group is kept (>=1 matching
-    # node) and only the filtered bucket is populated.
-    ready = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "groupBy": [{"name": "k8s.cluster.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "filter": {"filterByNodeReadiness": ["ready"]},
-        },
-        timeout=5,
-    )
-    assert ready.status_code == HTTPStatus.OK, ready.text
-    rdata = ready.json()["data"]
-    assert rdata["total"] == 1
-    assert rdata["records"][0]["nodeCountsByReadiness"] == {"ready": 2, "notReady": 0}
-
-    not_ready = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "groupBy": [{"name": "k8s.cluster.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "filter": {"filterByNodeReadiness": ["not_ready"]},
-        },
-        timeout=5,
-    )
-    assert not_ready.status_code == HTTPStatus.OK, not_ready.text
-    ndata = not_ready.json()["data"]
-    assert ndata["total"] == 1
-    assert ndata["records"][0]["nodeCountsByReadiness"] == {"ready": 0, "notReady": 1}
-
-    # Multi-select is OR: both buckets populated (union) for the kept group.
-    both = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "groupBy": [{"name": "k8s.cluster.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "filter": {"filterByNodeReadiness": ["ready", "not_ready"]},
-        },
-        timeout=5,
-    )
-    assert both.status_code == HTTPStatus.OK, both.text
-    bdata = both.json()["data"]
-    assert bdata["total"] == 1
-    assert bdata["records"][0]["nodeCountsByReadiness"] == {"ready": 2, "notReady": 1}
-
 
 @pytest.mark.parametrize(
     "group_key,expected",
@@ -793,95 +579,6 @@ def test_nodes_pagination(
     assert set(seen_nodes) == {f"page-n{i}" for i in range(1, K + 1)}
 
 
-def test_nodes_filter_readiness_pagination_and_ordering(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token,
-    insert_metrics,
-) -> None:
-    """filterByNodeReadiness composed with pagination + name ordering. The full-scope
-    readiness keyset is resolved before slicing, so total reflects the full matched
-    set and pages stay disjoint + complete on both the metric-ordering branch
-    (paginateWithBackfill) and the name-ordering branch (PaginateMetadataByName).
-    ready matches 4 nodes in nodes_conditions.jsonl: ready-n, ready-n2, ready-n3, ready-n4."""
-    now = datetime.now(tz=UTC).replace(microsecond=0)
-    insert_metrics(
-        Metrics.load_from_file(
-            get_testdata_file_path("inframonitoring/nodes_conditions.jsonl"),
-            base_time=now - timedelta(minutes=4),
-        )
-    )
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    start = int((now - timedelta(minutes=5)).timestamp() * 1000)
-    end = int(now.timestamp() * 1000)
-    matched = {"ready-n", "ready-n2", "ready-n3", "ready-n4"}
-
-    # Metric-ordering branch (default cpu order): total is invariant across a paged
-    # walk and the pages are disjoint + cover the full matched set.
-    seen: list[str] = []
-    totals: set[int] = set()
-    for offset in (0, 2, 4):
-        resp = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": start,
-                "end": end,
-                "limit": 2,
-                "offset": offset,
-                "filter": {"filterByNodeReadiness": ["ready"]},
-            },
-            timeout=5,
-        )
-        assert resp.status_code == HTTPStatus.OK, resp.text
-        data = resp.json()["data"]
-        totals.add(data["total"])
-        assert len(data["records"]) == max(0, min(2, 4 - offset)), f"offset={offset}: {data['records']!r}"
-        seen.extend(r["meta"]["k8s.node.name"] for r in data["records"])
-    assert totals == {4}, f"total not invariant under filter+pagination: {totals}"
-    assert len(seen) == 4, f"pages overlapped: {seen}"
-    assert set(seen) == matched
-
-    # Name-ordering branch (orderBy k8s.node.name asc, groupBy empty): the filtered
-    # set is returned in name order; total is the full matched count.
-    ordered = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": start,
-            "end": end,
-            "limit": 50,
-            "filter": {"filterByNodeReadiness": ["ready"]},
-            "orderBy": {"key": {"name": "k8s.node.name"}, "direction": "asc"},
-        },
-        timeout=5,
-    )
-    assert ordered.status_code == HTTPStatus.OK, ordered.text
-    odata = ordered.json()["data"]
-    assert odata["total"] == 4
-    assert [r["meta"]["k8s.node.name"] for r in odata["records"]] == ["ready-n", "ready-n2", "ready-n3", "ready-n4"]
-
-    # Second page of the name branch: PaginateMetadataByName slices the filtered set
-    # correctly (offset past the first 2 matched -> the last 2), total unchanged.
-    page2 = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": start,
-            "end": end,
-            "limit": 2,
-            "offset": 2,
-            "filter": {"filterByNodeReadiness": ["ready"]},
-            "orderBy": {"key": {"name": "k8s.node.name"}, "direction": "asc"},
-        },
-        timeout=5,
-    )
-    assert page2.status_code == HTTPStatus.OK, page2.text
-    p2 = page2.json()["data"]
-    assert p2["total"] == 4
-    assert [r["meta"]["k8s.node.name"] for r in p2["records"]] == ["ready-n3", "ready-n4"]
-
-
 # orderBy keys per nodes_constants.go:33-37 (snake_case request keys,
 # camelCase response fields). k8s.node.name sorts via the metadata-name branch
 # (PaginateMetadataByName) and is only allowed when groupBy is empty.
@@ -983,21 +680,6 @@ def test_nodes_orderby(  # pylint: disable=too-many-arguments,too-many-positiona
             "is only allowed when groupBy is empty",
             id="orderby_nodename_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid",
-        ),
-        pytest.param(
-            {"filter": {"filterByNodeReadiness": ["bogus"]}},
-            "invalid filter by node readiness",
-            id="filter_by_node_readiness_invalid",
-        ),
-        pytest.param(
-            {"filter": {"filterByNodeReadiness": ["notready"]}},
-            "invalid filter by node readiness",
-            id="filter_by_node_readiness_missing_underscore",
-        ),
     ],
 )
 def test_nodes_validation_errors(

tests/integration/tests/inframonitoring/04_namespaces.py

@@ -8,7 +8,6 @@ import requests
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.fs import get_testdata_file_path
-from fixtures.inframonitoring import expected_status_counts
 from fixtures.metrics import Metrics
 from fixtures.querier import compare_values, get_all_warnings
 
@@ -308,67 +307,6 @@ def test_namespaces_filter_invalid(
         assert any(err_substr in e["message"] for e in body["error"]["errors"]), f"{err_substr!r} not surfaced: {body['error']['errors']!r}"
 
 
-def test_namespaces_filter_by_pod_status(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token,
-    insert_metrics,
-) -> None:
-    """filterByPodStatus on namespaces: a namespace is kept when >=1 of its pods
-    matches the requested display status, and podCountsByStatus reflects only
-    that status (others 0); an absent status yields an empty page. Reuses
-    clusters_pod_phases.jsonl (carries k8s.namespace.name + full status metrics):
-    ns-x has running=3, crashLoopBackOff=1, error=1, evicted=1, pending=1."""
-    now = datetime.now(tz=UTC).replace(microsecond=0)
-    insert_metrics(
-        Metrics.load_from_file(
-            get_testdata_file_path("inframonitoring/clusters_pod_phases.jsonl"),
-            base_time=now - timedelta(minutes=4),
-        )
-    )
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # Multi-select is OR -> the union of requested buckets (others zeroed).
-    for fbps, expected in (
-        (["running"], expected_status_counts(running=3)),
-        (["CrashLoopBackOff"], expected_status_counts(crashLoopBackOff=1)),
-        (["running", "CrashLoopBackOff"], expected_status_counts(running=3, crashLoopBackOff=1)),
-    ):
-        resp = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert resp.status_code == HTTPStatus.OK, resp.text
-        data = resp.json()["data"]
-        assert data["total"] == 1
-        rec = data["records"][0]
-        assert rec["namespaceName"] == "ns-x"
-        assert rec["podCountsByStatus"] == expected
-
-    # A set fully absent from the namespace -> empty page (single and multi).
-    for fbps in (["completed"], ["completed", "oomKilled"]):
-        absent = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert absent.status_code == HTTPStatus.OK, absent.text
-        assert absent.json()["data"]["total"] == 0, f"namespace must be dropped by filterByPodStatus={fbps!r}"
-
-
 # Float record fields compared with tolerance; everything else compared with ==.
 _GROUPBY_FLOAT_FIELDS = {
     "namespaceCPU",
@@ -414,32 +352,6 @@ _GROUPBY_FLOAT_FIELDS = {
             },
             id="cluster",
         ),
-        # groupBy on a counted attr: regression guard for the counts-query
-        # alias collision (CH error 179).
-        pytest.param(
-            {
-                "fixture": "namespaces_groupby.jsonl",
-                "group_by": "k8s.deployment.name",
-                "filter": None,
-                "group_meta_keys": ["k8s.deployment.name"],
-                "expected_type": "grouped_list",
-                "groups": {
-                    "gb-dep-shared": {
-                        "namespaceName": "",
-                        "counts": {"deployments": 2, "daemonSets": 0, "jobs": 0, "statefulSets": 0},
-                    },
-                    "gb-dep-b3": {
-                        "namespaceName": "",
-                        "counts": {"deployments": 1, "daemonSets": 0, "jobs": 0, "statefulSets": 0},
-                    },
-                    "gb-dep-b4": {
-                        "namespaceName": "",
-                        "counts": {"deployments": 1, "daemonSets": 0, "jobs": 0, "statefulSets": 0},
-                    },
-                },
-            },
-            id="deployment_name_counted_attr",
-        ),
         # Default groupBy (no groupBy in request) => [k8s.namespace.name,
         # k8s.cluster.name] (module.go ListNamespaces), response list. Namespaces
         # are cluster-scoped, so a same-named namespace must NOT collapse across
@@ -683,11 +595,6 @@ def test_namespaces_orderby(  # pylint: disable=too-many-arguments,too-many-posi
             "is only allowed when groupBy is empty",
             id="orderby_nsname_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid",
-        ),
     ],
 )
 def test_namespaces_validation_errors(

tests/integration/tests/inframonitoring/05_clusters.py

@@ -8,7 +8,7 @@ import requests
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.fs import get_testdata_file_path
-from fixtures.inframonitoring import expected_resource_counts, expected_status_counts
+from fixtures.inframonitoring import expected_status_counts
 from fixtures.metrics import Metrics
 from fixtures.querier import compare_values, get_all_warnings
 
@@ -361,51 +361,6 @@ def test_clusters_node_readiness_aggregation(
     assert rec["clusterName"] == "rn-cluster"
     assert rec["nodeCountsByReadiness"] == {"ready": 3, "notReady": 2}
 
-    # filterByNodeReadiness: cluster kept (>=1 matching node), only the filtered
-    # bucket populated.
-    ready = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.cluster.name = 'rn-cluster'", "filterByNodeReadiness": ["ready"]},
-        },
-        timeout=5,
-    )
-    assert ready.status_code == HTTPStatus.OK, ready.text
-    assert ready.json()["data"]["records"][0]["nodeCountsByReadiness"] == {"ready": 3, "notReady": 0}
-
-    not_ready = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.cluster.name = 'rn-cluster'", "filterByNodeReadiness": ["not_ready"]},
-        },
-        timeout=5,
-    )
-    assert not_ready.status_code == HTTPStatus.OK, not_ready.text
-    assert not_ready.json()["data"]["records"][0]["nodeCountsByReadiness"] == {"ready": 0, "notReady": 2}
-
-    # Multi-select is OR: both buckets populated (union) for the kept cluster.
-    both = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.cluster.name = 'rn-cluster'", "filterByNodeReadiness": ["ready", "not_ready"]},
-        },
-        timeout=5,
-    )
-    assert both.status_code == HTTPStatus.OK, both.text
-    assert both.json()["data"]["records"][0]["nodeCountsByReadiness"] == {"ready": 3, "notReady": 2}
-
 
 def test_clusters_pod_status_aggregation(
     signoz: types.SigNoz,
@@ -447,109 +402,19 @@ def test_clusters_pod_status_aggregation(
     # All status metrics present -> gate satisfied -> no status warning.
     assert all("Pod status could not be computed" not in w["message"] for w in get_all_warnings(response.json()))
 
-    # filterByPodStatus: cluster kept (>=1 matching pod), only the filtered
-    # buckets populated. Multi-select is OR -> the union of requested buckets.
-    for fbps, expected in (
-        (["running"], expected_status_counts(running=3)),
-        (["CrashLoopBackOff"], expected_status_counts(crashLoopBackOff=1)),
-        (["running", "CrashLoopBackOff"], expected_status_counts(running=3, crashLoopBackOff=1)),
-    ):
-        resp = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"expression": "k8s.cluster.name = 'pp-cluster'", "filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert resp.status_code == HTTPStatus.OK, resp.text
-        fdata = resp.json()["data"]
-        assert fdata["total"] == 1
-        assert fdata["records"][0]["podCountsByStatus"] == expected
-
-    # A set fully absent from the cluster -> empty page (single and multi).
-    for fbps in (["completed"], ["completed", "oomKilled"]):
-        absent = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"expression": "k8s.cluster.name = 'pp-cluster'", "filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert absent.status_code == HTTPStatus.OK, absent.text
-        assert absent.json()["data"]["total"] == 0, f"cluster must be dropped by filterByPodStatus={fbps!r}"
-
-    # Combined filterByPodStatus + filterByNodeReadiness = AND. pp-cluster has a
-    # Ready node and Running pods -> kept when both match; dropped if either side
-    # has no match.
-    both_match = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.cluster.name = 'pp-cluster'", "filterByPodStatus": ["running"], "filterByNodeReadiness": ["ready"]},
-        },
-        timeout=5,
-    )
-    assert both_match.status_code == HTTPStatus.OK, both_match.text
-    bdata = both_match.json()["data"]
-    assert bdata["total"] == 1
-    assert bdata["records"][0]["podCountsByStatus"] == expected_status_counts(running=3)
-    assert bdata["records"][0]["nodeCountsByReadiness"] == {"ready": 1, "notReady": 0}
-
-    # readiness side fails (no not_ready node) -> dropped.
-    readiness_fails = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.cluster.name = 'pp-cluster'", "filterByPodStatus": ["running"], "filterByNodeReadiness": ["not_ready"]},
-        },
-        timeout=5,
-    )
-    assert readiness_fails.status_code == HTTPStatus.OK, readiness_fails.text
-    assert readiness_fails.json()["data"]["total"] == 0
-
-    # pod-status side fails (no completed pod) -> dropped.
-    status_fails = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.cluster.name = 'pp-cluster'", "filterByPodStatus": ["completed"], "filterByNodeReadiness": ["ready"]},
-        },
-        timeout=5,
-    )
-    assert status_fails.status_code == HTTPStatus.OK, status_fails.text
-    assert status_fails.json()["data"]["total"] == 0
-
 
 @pytest.mark.parametrize(
-    "group_key,flt,expected",
+    "group_key,expected",
     [
         # groupBy=[k8s.cluster.name]: one record per cluster, clusterName
         # populated (clusters.go:29-32). Each cluster has 1 ready node, 1 pod.
         pytest.param(
             "k8s.cluster.name",
-            None,
             {
-                "gb-gcp-1": {"readiness": {"ready": 1, "notReady": 0}, "counts": expected_resource_counts(nodes=1, namespaces=1)},
-                "gb-gcp-2": {"readiness": {"ready": 1, "notReady": 0}, "counts": expected_resource_counts(nodes=1, namespaces=1)},
-                "gb-aws-1": {"readiness": {"ready": 1, "notReady": 0}, "counts": expected_resource_counts(nodes=1, namespaces=1)},
-                "gb-aws-2": {"readiness": {"ready": 1, "notReady": 0}, "counts": expected_resource_counts(nodes=1, namespaces=1)},
+                "gb-gcp-1": {"readiness": {"ready": 1, "notReady": 0}},
+                "gb-gcp-2": {"readiness": {"ready": 1, "notReady": 0}},
+                "gb-aws-1": {"readiness": {"ready": 1, "notReady": 0}},
+                "gb-aws-2": {"readiness": {"ready": 1, "notReady": 0}},
             },
             id="cluster_name",
         ),
@@ -557,38 +422,25 @@ def test_clusters_pod_status_aggregation(
         # clusterName empty (custom-groupBy branch).
         pytest.param(
             "cloud.provider",
-            None,
             {
-                "gcp": {"readiness": {"ready": 2, "notReady": 0}, "counts": expected_resource_counts(nodes=2, namespaces=2)},
-                "aws": {"readiness": {"ready": 2, "notReady": 0}, "counts": expected_resource_counts(nodes=2, namespaces=2)},
+                "gcp": {"readiness": {"ready": 2, "notReady": 0}},
+                "aws": {"readiness": {"ready": 2, "notReady": 0}},
             },
             id="cloud_provider",
         ),
-        # groupBy on a counted attr: regression guard for the counts-query
-        # alias collision (CH error 179).
-        pytest.param(
-            "k8s.namespace.name",
-            "k8s.namespace.name = 'ns-x'",
-            {
-                "ns-x": {"readiness": {"ready": 0, "notReady": 0}, "counts": expected_resource_counts(nodes=4, namespaces=4)},
-            },
-            id="namespace_name_counted_attr",
-        ),
     ],
 )
-def test_clusters_groupby(  # pylint: disable=too-many-arguments,too-many-positional-arguments
+def test_clusters_groupby(
     signoz: types.SigNoz,
     create_user_admin: None,  # pylint: disable=unused-argument
     get_token,
     insert_metrics,
     group_key: str,
-    flt,
     expected: dict,
 ) -> None:
-    """groupBy returns one record per distinct group with aggregated readiness
-    and resource counts. clusterName is populated only when grouping by
-    k8s.cluster.name (clusters.go:29-32 list-vs-grouped branch); meta surfaces
-    the groupBy key."""
+    """groupBy returns one record per distinct group with aggregated readiness.
+    clusterName is populated only when grouping by k8s.cluster.name
+    (clusters.go:29-32 list-vs-grouped branch); meta surfaces the groupBy key."""
     now = datetime.now(tz=UTC).replace(microsecond=0)
     insert_metrics(
         Metrics.load_from_file(
@@ -598,24 +450,21 @@ def test_clusters_groupby(  # pylint: disable=too-many-arguments,too-many-positi
     )
 
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    body: dict = {
-        "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-        "end": int(now.timestamp() * 1000),
-        "limit": 50,
-        "groupBy": [
-            {
-                "name": group_key,
-                "fieldDataType": "string",
-                "fieldContext": "resource",
-            }
-        ],
-    }
-    if flt is not None:
-        body["filter"] = {"expression": flt}
     response = requests.post(
         signoz.self.host_configs["8080"].get(ENDPOINT),
         headers={"authorization": f"Bearer {token}"},
-        json=body,
+        json={
+            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "limit": 50,
+            "groupBy": [
+                {
+                    "name": group_key,
+                    "fieldDataType": "string",
+                    "fieldContext": "resource",
+                }
+            ],
+        },
         timeout=5,
     )
     assert response.status_code == HTTPStatus.OK, response.text
@@ -632,7 +481,6 @@ def test_clusters_groupby(  # pylint: disable=too-many-arguments,too-many-positi
         # empty otherwise.
         assert rec["clusterName"] == (group if group_key == "k8s.cluster.name" else "")
         assert rec["nodeCountsByReadiness"] == exp["readiness"]
-        assert rec["counts"] == exp["counts"], f"{group}: got {rec['counts']}, expected {exp['counts']}"
         assert group_key in rec["meta"], rec["meta"]
 
 
@@ -779,21 +627,6 @@ def test_clusters_orderby(  # pylint: disable=too-many-arguments,too-many-positi
             "is only allowed when groupBy is empty",
             id="orderby_clustername_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid",
-        ),
-        pytest.param(
-            {"filter": {"filterByNodeReadiness": ["bogus"]}},
-            "invalid filter by node readiness",
-            id="filter_by_node_readiness_invalid",
-        ),
-        pytest.param(
-            {"filter": {"filterByNodeReadiness": ["notready"]}},
-            "invalid filter by node readiness",
-            id="filter_by_node_readiness_missing_underscore",
-        ),
     ],
 )
 def test_clusters_validation_errors(

tests/integration/tests/inframonitoring/07_deployments.py

@@ -377,45 +377,6 @@ def test_deployments_pod_status_aggregation(
     # All status metrics present -> gate satisfied -> no status warning.
     assert all("Pod status could not be computed" not in w["message"] for w in get_all_warnings(response.json()))
 
-    # filterByPodStatus: deployment kept (>=1 matching pod), only the filtered
-    # buckets populated. Multi-select is OR -> the union of requested buckets.
-    for fbps, expected in (
-        (["running"], expected_status_counts(running=3)),
-        (["CrashLoopBackOff"], expected_status_counts(crashLoopBackOff=1)),
-        (["running", "CrashLoopBackOff"], expected_status_counts(running=3, crashLoopBackOff=1)),
-    ):
-        resp = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"expression": "k8s.deployment.name = 'pp-dep'", "filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert resp.status_code == HTTPStatus.OK, resp.text
-        fdata = resp.json()["data"]
-        assert fdata["total"] == 1
-        assert fdata["records"][0]["podCountsByStatus"] == expected
-
-    # A set fully absent from the deployment -> empty page (single and multi).
-    for fbps in (["completed"], ["completed", "oomKilled"]):
-        absent = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"expression": "k8s.deployment.name = 'pp-dep'", "filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert absent.status_code == HTTPStatus.OK, absent.text
-        assert absent.json()["data"]["total"] == 0, f"deployment must be dropped by filterByPodStatus={fbps!r}"
-
 
 def test_deployments_desired_available_counts(
     signoz: types.SigNoz,
@@ -822,11 +783,6 @@ def test_deployments_orderby(  # pylint: disable=too-many-arguments,too-many-pos
             "is only allowed when groupBy is empty",
             id="orderby_depname_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid",
-        ),
     ],
 )
 def test_deployments_validation_errors(

tests/integration/tests/inframonitoring/08_statefulsets.py

@@ -8,7 +8,6 @@ import requests
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.fs import get_testdata_file_path
-from fixtures.inframonitoring import expected_status_counts
 from fixtures.metrics import Metrics
 from fixtures.querier import compare_values, get_all_warnings
 
@@ -327,77 +326,6 @@ def test_statefulsets_base_filter_drops_non_statefulset_pods(
     # No empty-name group leaking through.
     assert all(r["statefulSetName"] != "" for r in data["records"])
 
-    # filterByPodStatus: ns-ss (ns-ss-p1 Running + ns-ss-p1-clbo CrashLoopBackOff)
-    # is kept when >=1 pod matches; counts reflect only the filtered status; an
-    # absent status yields an empty page. Metric aggregation stays undistorted.
-    unfiltered_cpu = rec["statefulSetCPU"]
-
-    running = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["running"]},
-        },
-        timeout=5,
-    )
-    assert running.status_code == HTTPStatus.OK, running.text
-    rdata = running.json()["data"]
-    assert rdata["total"] == 1
-    rrec = rdata["records"][0]
-    assert rrec["statefulSetName"] == "ns-ss"
-    assert rrec["podCountsByStatus"] == expected_status_counts(running=1)
-    assert compare_values(rrec["statefulSetCPU"], unfiltered_cpu, 1e-6), "filterByPodStatus distorted statefulSetCPU"
-
-    clbo = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert clbo.status_code == HTTPStatus.OK, clbo.text
-    cdata = clbo.json()["data"]
-    assert cdata["total"] == 1
-    assert cdata["records"][0]["podCountsByStatus"] == expected_status_counts(crashLoopBackOff=1)
-
-    # Multi-select is OR: both requested buckets populated (union), others zeroed.
-    multi = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["running", "CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert multi.status_code == HTTPStatus.OK, multi.text
-    assert multi.json()["data"]["records"][0]["podCountsByStatus"] == expected_status_counts(running=1, crashLoopBackOff=1)
-
-    # A set fully absent from the group -> empty page (single and multi-select).
-    for fbps in (["pending"], ["pending", "oomKilled"]):
-        absent = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert absent.status_code == HTTPStatus.OK, absent.text
-        assert absent.json()["data"]["total"] == 0, f"group must be dropped by filterByPodStatus={fbps!r}"
-
 
 # Float record fields compared with tolerance; everything else compared with ==.
 _GROUPBY_FLOAT_FIELDS = {
@@ -727,11 +655,6 @@ def test_statefulsets_orderby(  # pylint: disable=too-many-arguments,too-many-po
             "is only allowed when groupBy is empty",
             id="orderby_ssname_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid",
-        ),
     ],
 )
 def test_statefulsets_validation_errors(

tests/integration/tests/inframonitoring/09_jobs.py

@@ -8,7 +8,6 @@ import requests
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.fs import get_testdata_file_path
-from fixtures.inframonitoring import expected_status_counts
 from fixtures.metrics import Metrics
 from fixtures.querier import compare_values, get_all_warnings
 
@@ -459,77 +458,6 @@ def test_jobs_base_filter_drops_non_job_pods(
     assert rec["jobName"] == "nj-job"
     assert all(r["jobName"] != "" for r in data["records"])
 
-    # filterByPodStatus: nj-job (nj-job-p1 Running + nj-job-p1-clbo CrashLoopBackOff)
-    # is kept when >=1 pod matches; counts reflect only the filtered status; an
-    # absent status yields an empty page. Metric aggregation stays undistorted.
-    unfiltered_cpu = rec["jobCPU"]
-
-    running = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["running"]},
-        },
-        timeout=5,
-    )
-    assert running.status_code == HTTPStatus.OK, running.text
-    rdata = running.json()["data"]
-    assert rdata["total"] == 1
-    rrec = rdata["records"][0]
-    assert rrec["jobName"] == "nj-job"
-    assert rrec["podCountsByStatus"] == expected_status_counts(running=1)
-    assert compare_values(rrec["jobCPU"], unfiltered_cpu, 1e-6), "filterByPodStatus distorted jobCPU"
-
-    clbo = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert clbo.status_code == HTTPStatus.OK, clbo.text
-    cdata = clbo.json()["data"]
-    assert cdata["total"] == 1
-    assert cdata["records"][0]["podCountsByStatus"] == expected_status_counts(crashLoopBackOff=1)
-
-    # Multi-select is OR: both requested buckets populated (union), others zeroed.
-    multi = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["running", "CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert multi.status_code == HTTPStatus.OK, multi.text
-    assert multi.json()["data"]["records"][0]["podCountsByStatus"] == expected_status_counts(running=1, crashLoopBackOff=1)
-
-    # A set fully absent from the group -> empty page (single and multi-select).
-    for fbps in (["pending"], ["pending", "oomKilled"]):
-        absent = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert absent.status_code == HTTPStatus.OK, absent.text
-        assert absent.json()["data"]["total"] == 0, f"group must be dropped by filterByPodStatus={fbps!r}"
-
 
 # Float record fields compared with tolerance; everything else compared with ==.
 _GROUPBY_FLOAT_FIELDS = {
@@ -866,11 +794,6 @@ def test_jobs_orderby(  # pylint: disable=too-many-arguments,too-many-positional
             "is only allowed when groupBy is empty",
             id="orderby_jobname_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid",
-        ),
     ],
 )
 def test_jobs_validation_errors(

tests/integration/tests/inframonitoring/10_daemonsets.py

@@ -8,7 +8,6 @@ import requests
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.fs import get_testdata_file_path
-from fixtures.inframonitoring import expected_status_counts
 from fixtures.metrics import Metrics
 from fixtures.querier import compare_values, get_all_warnings
 
@@ -334,77 +333,6 @@ def test_daemonsets_base_filter_drops_non_daemonset_pods(
     assert rec["daemonSetName"] == "nd-ds"
     assert all(r["daemonSetName"] != "" for r in data["records"])
 
-    # filterByPodStatus: nd-ds (nd-ds-p1 Running + nd-ds-p1-clbo CrashLoopBackOff)
-    # is kept when >=1 pod matches; counts reflect only the filtered status; an
-    # absent status yields an empty page. Metric aggregation stays undistorted.
-    unfiltered_cpu = rec["daemonSetCPU"]
-
-    running = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["running"]},
-        },
-        timeout=5,
-    )
-    assert running.status_code == HTTPStatus.OK, running.text
-    rdata = running.json()["data"]
-    assert rdata["total"] == 1
-    rrec = rdata["records"][0]
-    assert rrec["daemonSetName"] == "nd-ds"
-    assert rrec["podCountsByStatus"] == expected_status_counts(running=1)
-    assert compare_values(rrec["daemonSetCPU"], unfiltered_cpu, 1e-6), "filterByPodStatus distorted daemonSetCPU"
-
-    clbo = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert clbo.status_code == HTTPStatus.OK, clbo.text
-    cdata = clbo.json()["data"]
-    assert cdata["total"] == 1
-    assert cdata["records"][0]["podCountsByStatus"] == expected_status_counts(crashLoopBackOff=1)
-
-    # Multi-select is OR: both requested buckets populated (union), others zeroed.
-    multi = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByPodStatus": ["running", "CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert multi.status_code == HTTPStatus.OK, multi.text
-    assert multi.json()["data"]["records"][0]["podCountsByStatus"] == expected_status_counts(running=1, crashLoopBackOff=1)
-
-    # A set fully absent from the group -> empty page (single and multi-select).
-    for fbps in (["pending"], ["pending", "oomKilled"]):
-        absent = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-                "end": int(now.timestamp() * 1000),
-                "limit": 50,
-                "filter": {"filterByPodStatus": fbps},
-            },
-            timeout=5,
-        )
-        assert absent.status_code == HTTPStatus.OK, absent.text
-        assert absent.json()["data"]["total"] == 0, f"group must be dropped by filterByPodStatus={fbps!r}"
-
 
 # Float record fields compared with tolerance; everything else compared with ==.
 _GROUPBY_FLOAT_FIELDS = {
@@ -735,11 +663,6 @@ def test_daemonsets_orderby(  # pylint: disable=too-many-arguments,too-many-posi
             "is only allowed when groupBy is empty",
             id="orderby_dsname_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByPodStatus": ["Bogus"]}},
-            "invalid filter by pod status",
-            id="filter_by_pod_status_invalid",
-        ),
     ],
 )
 def test_daemonsets_validation_errors(

tests/integration/tests/inframonitoring/12_kube_containers.py

@@ -120,84 +120,6 @@ def test_kube_containers_status_health_and_base_set(
         else:
             assert rec["cpu"] == -1, f"{pod}: expected cpu -1 sentinel (base-set-only), got {rec['cpu']}"
 
-    # filterByContainerStatus (secondary filter): matching status keeps the
-    # container; a mismatched status filters it out. Wire value is
-    # case-insensitive (valuer lowercases): "running" == "Running".
-    crun_running = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.pod.name = 'crun'", "filterByContainerStatus": ["running"]},
-        },
-        timeout=5,
-    )
-    assert crun_running.status_code == HTTPStatus.OK, crun_running.text
-    cr = crun_running.json()["data"]
-    assert cr["total"] == 1
-    assert cr["records"][0]["meta"]["k8s.pod.name"] == "crun"
-
-    cclo_clbo = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.pod.name = 'cclo'", "filterByContainerStatus": ["CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert cclo_clbo.status_code == HTTPStatus.OK, cclo_clbo.text
-    assert cclo_clbo.json()["data"]["total"] == 1
-
-    # crun is Running, not CrashLoopBackOff -> filtered out.
-    crun_mismatch = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.pod.name = 'crun'", "filterByContainerStatus": ["CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert crun_mismatch.status_code == HTTPStatus.OK, crun_mismatch.text
-    assert crun_mismatch.json()["data"]["total"] == 0
-
-    # Multi-select is OR: a set containing the container's status keeps it; a set
-    # with none of its statuses drops it.
-    crun_or_keep = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.pod.name = 'crun'", "filterByContainerStatus": ["running", "CrashLoopBackOff"]},
-        },
-        timeout=5,
-    )
-    assert crun_or_keep.status_code == HTTPStatus.OK, crun_or_keep.text
-    assert crun_or_keep.json()["data"]["total"] == 1
-
-    crun_all_mismatch = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"expression": "k8s.pod.name = 'crun'", "filterByContainerStatus": ["CrashLoopBackOff", "OOMKilled"]},
-        },
-        timeout=5,
-    )
-    assert crun_all_mismatch.status_code == HTTPStatus.OK, crun_all_mismatch.text
-    assert crun_all_mismatch.json()["data"]["total"] == 0
-
 
 def test_kube_containers_status_counts_grouped_mode(
     signoz: types.SigNoz,
@@ -243,95 +165,6 @@ def test_kube_containers_status_counts_grouped_mode(
     assert ns_b["oomKilled"] == 1
     assert by_ns["ns-b"]["containerCountsByReady"] == {"ready": 0, "notReady": 2}
 
-    # filterByContainerStatus in grouped mode: keep only groups with a matching
-    # container, only that bucket populated; a group with none is dropped.
-    running = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "groupBy": [{"name": "k8s.namespace.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "limit": 50,
-            "filter": {"filterByContainerStatus": ["running"]},
-        },
-        timeout=5,
-    )
-    assert running.status_code == HTTPStatus.OK, running.text
-    rdata = running.json()["data"]
-    # ns-a has running containers, ns-b has none -> only ns-a.
-    assert {r["meta"]["k8s.namespace.name"] for r in rdata["records"]} == {"ns-a"}
-    assert rdata["records"][0]["containerCountsByStatus"]["running"] == 2
-
-    oom = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "groupBy": [{"name": "k8s.namespace.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "limit": 50,
-            "filter": {"filterByContainerStatus": ["OOMKilled"]},
-        },
-        timeout=5,
-    )
-    assert oom.status_code == HTTPStatus.OK, oom.text
-    odata = oom.json()["data"]
-    assert {r["meta"]["k8s.namespace.name"] for r in odata["records"]} == {"ns-b"}
-    assert odata["records"][0]["containerCountsByStatus"]["oomKilled"] == 1
-
-    # A status absent from every group -> empty page.
-    absent = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "groupBy": [{"name": "k8s.namespace.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "limit": 50,
-            "filter": {"filterByContainerStatus": ["Terminated"]},
-        },
-        timeout=5,
-    )
-    assert absent.status_code == HTTPStatus.OK, absent.text
-    assert absent.json()["data"]["total"] == 0
-
-    # Multi-select is OR: keeps every group with any matching container (union
-    # across groups); a fully-absent set drops all.
-    union = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "groupBy": [{"name": "k8s.namespace.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "limit": 50,
-            "filter": {"filterByContainerStatus": ["running", "OOMKilled"]},
-        },
-        timeout=5,
-    )
-    assert union.status_code == HTTPStatus.OK, union.text
-    udata = union.json()["data"]
-    u_by_ns = {r["meta"]["k8s.namespace.name"]: r for r in udata["records"]}
-    assert set(u_by_ns) == {"ns-a", "ns-b"}
-    assert u_by_ns["ns-a"]["containerCountsByStatus"]["running"] == 2
-    assert u_by_ns["ns-b"]["containerCountsByStatus"]["oomKilled"] == 1
-
-    absent_multi = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "groupBy": [{"name": "k8s.namespace.name", "fieldDataType": "string", "fieldContext": "resource"}],
-            "limit": 50,
-            "filter": {"filterByContainerStatus": ["Terminated", "Waiting"]},
-        },
-        timeout=5,
-    )
-    assert absent_multi.status_code == HTTPStatus.OK, absent_multi.text
-    assert absent_multi.json()["data"]["total"] == 0
-
 
 def test_kube_containers_status_recency(
     signoz: types.SigNoz,
@@ -450,31 +283,6 @@ def test_kube_containers_status_warning_missing_metrics(
     warnings = get_all_warnings(body)
     assert any("status.state" in w["message"] and "status.reason" in w["message"] for w in warnings), f"status warning naming the missing metrics not surfaced: {warnings!r}"
 
-    # filterByContainerStatus + missing status metrics: the up-front gate returns
-    # the warning and an empty page (Total 0) rather than silently filtering
-    # everything out.
-    filtered = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": int((now - timedelta(minutes=5)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "limit": 50,
-            "filter": {"filterByContainerStatus": ["Running"]},
-        },
-        timeout=5,
-    )
-    assert filtered.status_code == HTTPStatus.OK, filtered.text
-    fdata = filtered.json()["data"]
-    assert fdata["total"] == 0
-    assert fdata["records"] == []
-    # The gate warning on the filtered path is surfaced at the top-level
-    # warning.message (the up-front early return sets it directly); collect both
-    # that and any nested warnings.
-    fwarn = fdata.get("warning") or {}
-    fmsgs = ([fwarn["message"]] if fwarn.get("message") else []) + [w["message"] for w in fwarn.get("warnings", [])]
-    assert any("status.state" in m and "status.reason" in m for m in fmsgs), f"gate warning missing on filtered call: {fmsgs!r}"
-
 
 def test_kube_containers_filter(
     signoz: types.SigNoz,
@@ -566,107 +374,6 @@ def test_kube_containers_orderby_and_pagination(
     assert seen == order, f"paginated sequence {seen} != full-page order {order}"
 
 
-def test_kube_containers_filter_pagination_and_ordering(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token,
-    insert_metrics,
-) -> None:
-    """filterByContainerStatus (multi-select) composed with pagination + name
-    ordering. The full-scope status keyset is resolved before slicing, so total
-    reflects the full matched set and pages stay disjoint + complete on both the
-    metric-ordering branch (paginateWithBackfill -- including its metadata-only
-    backfill arm, since coom has no cpu metric) and the name-ordering branch
-    (PaginateMetadataByName). ['running','crashloopbackoff','oomkilled'] matches 4
-    containers in kube_containers_dataset.jsonl: crun, cnr, cclo, coom.
-
-    Name-branch order is not asserted: every container shares k8s.container.name
-    ('app'), so the sort ties -- we assert the filtered set + disjoint/complete pages."""
-    now = datetime.now(tz=UTC).replace(microsecond=0)
-    insert_metrics(
-        Metrics.load_from_file(
-            get_testdata_file_path("inframonitoring/kube_containers_dataset.jsonl"),
-            base_time=now - timedelta(minutes=4),
-        )
-    )
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    start = int((now - timedelta(minutes=5)).timestamp() * 1000)
-    end = int(now.timestamp() * 1000)
-    statuses = ["running", "crashloopbackoff", "oomkilled"]
-    matched = {"crun", "cnr", "cclo", "coom"}
-
-    # Metric-ordering branch (default cpu order): total is invariant across a paged
-    # walk and the pages are disjoint + cover the full matched set (coom arrives via
-    # the metadata-only backfill arm). Non-matching containers never appear.
-    seen: list[str] = []
-    totals: set[int] = set()
-    for offset in (0, 2, 4):
-        resp = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": start,
-                "end": end,
-                "limit": 2,
-                "offset": offset,
-                "filter": {"filterByContainerStatus": statuses},
-            },
-            timeout=5,
-        )
-        assert resp.status_code == HTTPStatus.OK, resp.text
-        data = resp.json()["data"]
-        totals.add(data["total"])
-        assert len(data["records"]) == max(0, min(2, 4 - offset)), f"offset={offset}: {data['records']!r}"
-        seen.extend(r["meta"]["k8s.pod.name"] for r in data["records"])
-    assert totals == {4}, f"total not invariant under filter+pagination: {totals}"
-    assert len(seen) == 4, f"pages overlapped: {seen}"
-    assert set(seen) == matched
-
-    # Name-ordering branch (orderBy k8s.container.name asc, groupBy empty): the
-    # filtered set is returned and total is the full matched count.
-    ordered = requests.post(
-        signoz.self.host_configs["8080"].get(ENDPOINT),
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "start": start,
-            "end": end,
-            "limit": 50,
-            "filter": {"filterByContainerStatus": statuses},
-            "orderBy": {"key": {"name": "k8s.container.name"}, "direction": "asc"},
-        },
-        timeout=5,
-    )
-    assert ordered.status_code == HTTPStatus.OK, ordered.text
-    odata = ordered.json()["data"]
-    assert odata["total"] == 4
-    assert {r["meta"]["k8s.pod.name"] for r in odata["records"]} == matched
-
-    # Name branch paginated: PaginateMetadataByName slices the filtered set into
-    # disjoint pages that together cover it, with total unchanged.
-    name_seen: list[str] = []
-    for offset in (0, 2):
-        resp = requests.post(
-            signoz.self.host_configs["8080"].get(ENDPOINT),
-            headers={"authorization": f"Bearer {token}"},
-            json={
-                "start": start,
-                "end": end,
-                "limit": 2,
-                "offset": offset,
-                "filter": {"filterByContainerStatus": statuses},
-                "orderBy": {"key": {"name": "k8s.container.name"}, "direction": "asc"},
-            },
-            timeout=5,
-        )
-        assert resp.status_code == HTTPStatus.OK, resp.text
-        data = resp.json()["data"]
-        assert data["total"] == 4
-        assert len(data["records"]) == 2, f"offset={offset}: {data['records']!r}"
-        name_seen.extend(r["meta"]["k8s.pod.name"] for r in data["records"])
-    assert len(name_seen) == 4, f"name-branch pages overlapped: {name_seen}"
-    assert set(name_seen) == matched
-
-
 @pytest.mark.parametrize(
     ("payload_override", "err_substr"),
     [
@@ -691,16 +398,6 @@ def test_kube_containers_filter_pagination_and_ordering(
             "is only allowed when groupBy is empty",
             id="orderby_container_name_with_groupby",
         ),
-        pytest.param(
-            {"filter": {"filterByContainerStatus": ["bogus"]}},
-            "invalid filter by container status",
-            id="filter_by_container_status_invalid",
-        ),
-        pytest.param(
-            {"filter": {"filterByContainerStatus": ["no_data"]}},
-            "invalid filter by container status",
-            id="filter_by_container_status_no_data",
-        ),
     ],
 )
 def test_kube_containers_validation_errors(