fix(profiling): enable controller profiling and update docs

[theakshaypant]

📝 Description of the Change

• Bump knative/eventing to v0.49.0 which includes the pprof server fix (knative/eventing#9008) - the adapter framework now calls ListenAndServe so controller profiling actually works
• Update the profiling guide for the OpenCensus → OpenTelemetry replace profiling.enable with runtime-profiling: enabled/disabled remove the obsolete K_METRICS_CONFIG controller section, and document per-component prerequisites
• Also bumps k8s.io to v0.35.4, knative/pkg, and golang.org/x dependencies

Contains two commits:

• chore(deps): bump knative/eventing to v0.49.0
• docs(profiling): update guide for OTel migration

🔗 Linked GitHub Issue

Fixes #2633

🧪 Testing Strategy

• Unit tests
• Integration tests
• End-to-end tests
• Manual testing - Tested collection of profiles from all three pods
• Not Applicable

🤖 AI Assistance

AI assistance can be used for various tasks, such as code generation,
documentation, or testing.

Please indicate whether you have used AI assistance
for this PR and provide details if applicable.

• I have not used any AI assistance for this PR.
• I have used AI assistance for this PR.

Important

Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Claude noreply@anthropic.com

✅ Submitter Checklist

• 📝 My commit messages are clear, informative, and follow the project's How to write a git commit message guide. The Gitlint linter ensures in CI it's properly validated
• ✨ I have ensured my commit message prefix (e.g., fix:, feat:) matches the "Type of Change" I selected above.
• ♽ I have run make test and make lint locally to check for and fix any
  issues. For an efficient workflow, I have considered installing
  pre-commit and running pre-commit install to
  automate these checks.
• 📖 I have added or updated documentation for any user-facing changes.
• 🧪 I have added sufficient unit tests for my code changes.
• 🎁 I have added end-to-end tests where feasible. See README for more details.
• 🔎 I have addressed any CI test flakiness or provided a clear reason to bypass it.
• If adding a provider feature, I have filled in the following and updated the provider documentation:
  • GitHub App
  • GitHub Webhook
  • Gitea/Forgejo
  • GitLab
  • Bitbucket Cloud
  • Bitbucket Data Center

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.29%. Comparing base (c615efb) to head (bc23ca6).
⚠️ Report is 2 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2720      +/-   ##
==========================================
+ Coverage   59.25%   59.29%   +0.03%     
==========================================
  Files         208      208              
  Lines       20573    20590      +17     
==========================================
+ Hits        12191    12208      +17     
  Misses       7610     7610              
  Partials      772      772              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gemini-code-assist]

Code Review

This pull request updates the profiling documentation to reflect changes in ConfigMap keys and provides clearer component-specific instructions. It also updates several Go dependencies, including Kubernetes and Knative libraries. Review feedback identified a duplicate major version dependency for go-github in go.mod that should be consolidated. Additionally, a logic error was found in the documentation's shell script where a hardcoded port assignment would overwrite a user-defined profiling port, potentially leading to unreachable endpoints.

[gemini-code-assist]

The go.mod file now lists both v84 and v85 of github.com/google/go-github as direct dependencies. This is likely an error during the dependency update process. Having multiple major versions of the same library as direct dependencies increases maintenance complexity and can lead to type conflicts if objects are passed between packages using different versions. Please consolidate on a single version (preferably v85) and remove this duplicate entry.

[chmouel]

Code review

Branch: fix/enable-profiling → main
PR: #2720 (draft)
Review ID: rev_01KREAPJC55X1BN6DXJRED2FC8
Fix threshold: not yet set (run /adamsreview:fix [threshold] to apply fixes)
Sub-agent tokens: 563,926 across 14 invocations

Found 11 findings across all lanes:

• Light lane (ux/policy/architecture): 2 manual, 1 uncertain
• Pre-existing (high-confidence origin, report-only): 1
• Filtered out: 4 disproven, 3 below score gate (<45)

---

Deep lane — correctness & security

Auto-recommendations (2)

AI-authored fix directions for findings that aren't auto-fixable today. Run /adamsreview:fix to batch-apply with one confirmation, or /adamsreview:walkthrough to review one-by-one.

#	Score	Disp	File	Recommendation
F004	82	manual	docs/content/docs/operations/profiling.md:54-55	high: Add a note after line 55 explaining that prior to the Knative eventing v0.49.0 upgrade, controller profiling did not work at all (the eve...
F007	68	manual	docs/content/docs/operations/profiling.md:129-132	medium: Replace hardcoded 8008:8008 in line 132 with ${PROFILING_PORT}:${PROFILING_PORT} (using the variable set in line 91), and update all subs...

Full recommendations and alternatives

F004 — The controller docs state profiling config is read once at startup and not watched, but the eventing adapter in v0.49.0 now actually starts the profiling server, meaning the controller profiling was completely broken before this PR -- the docs should note this behavioral change.

File: docs/content/docs/operations/profiling.md:54-55
Score: 82 (strong)
Reason: Controller profiling behavioral change (new in v0.49.0) warrants clearer documentation noting the change
Auto-recommendation (high): Add a note after line 55 explaining that prior to the Knative eventing v0.49.0 upgrade, controller profiling did not work at all (the eventing adapter did not start the profiling server). The current behavior—reading config once at startup—is a functional improvement over the previous non-functional state. Consider adding a callout box or note admonition if Hugo supports it.

• Alternatives: B Rephrase the entire controller row

F007 — Port-forward command and all subsequent examples use hardcoded port 8008 despite earlier section telling users to change PROFILING_PORT.

File: docs/content/docs/operations/profiling.md:129-132
Score: 68 (moderate)
Reason: Port-forward and pprof examples all hardcode 8008 despite PROFILING_PORT customization section
Auto-recommendation (medium): Replace hardcoded 8008:8008 in line 132 with ${PROFILING_PORT}:${PROFILING_PORT} (using the variable set in line 91), and update all subsequent example URLs (lines 135, 143, 146, 149, 159) to use ${PROFILING_PORT} or explicitly remind users to substitute their custom port. Alternatively, add a single prominent note before line 129 stating 'The examples below assume the default port 8008; substitute your PROFILING_PORT value if you changed it.'

• Concerns: Primary hint assumes PROFILING_PORT variable is in scope at line 132, but it is only defined within the shell loop at lines 91-98 and not exported; Hint does not clearly specify how to make the variable available to subsequent shell examples (export statement, inline assignment, or reading from deployment); Alternative B is more viable but still ambiguous about the source of the PROFILING_PORT value (hardcoded default vs. reading from actual deployment configuration)
• Alternatives: B Add variable substitution in shell examples

Light lane — ux, policy, architecture

Light-lane findings — including rows labeled auto-fixable — aren't applied by /adamsreview:fix directly. Findings with an auto-recommendation get batch-confirmed at :fix's Phase 7.5 preflight (or :walkthrough Step 4.5); use /adamsreview:promote <finding_id> for a single-finding manual override.

#	Score	Impact	File	Finding	Disposition
F004	82	ux	docs/content/docs/operations/profiling.md:54-55	The controller docs state profiling config is read once at startup and not watched, but the eventing adapter in v0.49.0 now actually starts the profiling server, meaning the controller profiling was completely broken before this PR -- the docs should note this behavioral change.	manual
F007	68	ux	docs/content/docs/operations/profiling.md:129-132	Port-forward command and all subsequent examples use hardcoded port 8008 despite earlier section telling users to change PROFILING_PORT.	manual
F009	55	ux	docs/content/docs/operations/profiling.md:55-56	Critical controller prerequisite is buried in a table cell, making it easy to miss the restart requirement	uncertain

Pre-existing — report-only (1)

Shown only when origin_confidence: high. Never auto-fixed in v1 (§13.1 pre-existing override).

#	Score	File	Finding	Follow-up
F013		docs/content/docs/operations/profiling.md:18-29	Documentation instructs exposing debug/pprof endpoints on port 8008 which can leak sensitive runtime data including heap contents, goroutines, and execution traces

---

🤖 Generated with the adamsreview Claude Code Review Plugin

[theakshaypant]

This is a very nice, thorough review, thanks! (Will try this skill for some other reviews)

docs/content/docs/operations/profiling.md:54-55: The controller docs state profiling config is read once at startup and not watched, but the eventing adapter in v0.49.0 now actually starts the profiling server, meaning the controller profiling was completely broken before this PR -- the docs should note this behavioral change.

Since the docs represent the current state of the codebase, they should reflect the actual behavior, not a changelog entry. Chose to skip this.

docs/content/docs/operations/profiling.md:129-132: Port-forward command and all subsequent examples use hardcoded port 8008 despite earlier section telling users to change PROFILING_PORT.

Fixed in 54bce76, made use of the PROFILING_PORT environment variable everywhere in the doc.

docs/content/docs/operations/profiling.md:55-56: Critical controller prerequisite is buried in a table cell, making it easy to miss the restart requirement

This is a good ux pointer. Made the restart requirement more prominent in 54bce76

Page Screenshot