fix(topology): prevent security_confinement_disabled gauge from expiring

[thomasqueirozb]

Summary

The vector_security_confinement_disabled gauge was emitted once per sink at build time and its handle dropped immediately, so the metric aged out of the registry after the idle timeout (300s by default) while the sink was still running with confinement disabled. Ownership of the gauge is moved to the topology, which holds a handle for each confinement-aware sink's lifetime and reconciles the gauges on every (re)load.

Without this fix, any dashboard or alert watching vector_security_confinement_disabled silently loses signal ~5 minutes after startup, making it impossible to detect sinks running with confinement disabled for the rest of their lifetime. An absent gauge was also indistinguishable from a sink that had been removed or renamed.

Vector configuration

sources:
  dummy:
    type: demo_logs
    format: json
    interval: 30

  internal:
    type: internal_metrics
    scrape_interval_secs: 15

transforms:
  only_confinement:
    type: filter
    inputs: [internal]
    condition: .name == "security_confinement_disabled"

sinks:
  confinement_sink:
    type: file
    inputs: [dummy]
    path: /tmp/vector-confinement-test.log
    encoding:
      codec: text

  watch:
    type: console
    inputs: [only_confinement]
    encoding:
      codec: json

How did you test this PR?

Before it stopped outputting to the console after 300s (20 logs) and now it continues.

make check-clippy, make check-fmt, and make check-changelog-fragments all pass. Added src/topology/test/confinement_gauge.rs covering per-sink series at startup, absence for non-confinement sinks, and value updates on reload; the topology test suite passes (cargo nextest run --lib topology::test::).

Change Type

• Bug fix
• New feature
• Dependencies
• Non-functional (chore, refactoring, docs)
• Performance

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

References

NA

[thomasqueirozb]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 6db1b56057

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[pront]

Good fix. I am not a fan of the changes in src/topology/running.rs but that is a pre-existing issue. We can address this in a follow-up. Approving to fix this bug.

Note: I also suspect this fixes another bug where in some cases the tags point to the wrong component id.