Add per-request image count to logs and metrics

[bdehamer]

Summary

When Gatekeeper's admission controller validates a pod, it sends all of the pod's image references in a single external-data request. Today we have no visibility into how many images ride along in each request. This PR captures that count to support two goals:

1. Distribution analysis — are we primarily validating single-image pods, or large multi-image pods?
2. Timeout troubleshooting (primary driver) — when an attestation fetch fails with canceled/timeout (context_cancelled), trace that specific failure back to determine whether it was a solo validation or one image in a larger, multi-image request that ran out of time.

The provider processes images sequentially in one loop that shares the request context/deadline, so later images in a big request are the ones most likely to time out — which is exactly the pattern these fields surface.

Changes

• pkg/metrics/prom.go — new histogram aaop_attestations_request_images (buckets 1, 2, 3, 5, 10, 20, 50), observed once per request. A histogram (not a counter or a label) is the right tool: it yields the distribution (_bucket{le="1"} / _count for the single-image fraction, histogram_quantile for percentiles, _sum/_count for the average) without exploding metric label cardinality.
• pkg/provider/provider.go — in Validate, generate a per-request request_id (UUID) and thread request_id + image_count + image_index through the per-image log lines via slog.With. Every per-image line (success and failure) now self-describes its request context, so a single reason="canceled"/"timeout" line reads e.g. image_count=17, image_index=14 → "image 14 of a 17-image request ran out of time."
• go.mod — promote github.com/google/uuid from an indirect to a direct dependency (already in the module graph).
• pkg/provider/provider_test.go — a histogram test (_count +1, _sum +N) and a log-correlation test asserting a failure line's request_id matches the request entry line and carries image_count/image_index.
• README.md — document the new metric and log fields.

Pure observability — no change to the provider's request/response contract or verification behavior.

Example log line after this change

{"level":"ERROR","msg":"validate: error fetching bundles","request_id":"…",
 "image_count":17,"image_index":14,"image":"…","reason":"canceled",…}

Validation

• go build ./...
• go test ./... (all packages pass)
• golangci-lint run on changed packages — clean

Notes / trade-offs

• Buckets are a tunable starting point; add a higher bucket if very large pods appear in real traffic.
• The entry log is INFO, one line per request; per-image lines already existed and simply gain fields.

[Copilot]

Pull request overview

Adds per-request image-count observability for validation and timeout troubleshooting.

Changes:

• Adds an image-count histogram.
• Correlates request and per-image logs using UUIDs and image indexes.
• Adds tests and documentation for the new telemetry.

Show a summary per file

File	Description
README.md	Documents metrics and log fields.
go.mod	Promotes the UUID dependency.
pkg/metrics/prom.go	Defines the image-count histogram.
pkg/provider/provider.go	Records metrics and structured request context.
pkg/provider/provider_test.go	Tests histogram and log correlation behavior.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Balanced