Kubernetes Events Filtering

By default, OpsRamp agents notify Kubernetes events for all namespaces. However, you can customize it by defining custom rules to alert on events related to specific namespaces.

To monitor Kubernetes events based on defined rules, add the filters attribute to the OpsRamp agent’s kube-events configMap.

The include and exclude options accept lists of regular expressions.

Filter

    
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: kube-events
      labels:
        name: kube-events
      namespace: opsramp-agent
    data:
      eventsConfig.yaml: |
        filters:
          namespace:
            include:
              -
            exclude:  
              -
          pod: 
            include: 
              -  
            exclude: 
              -      
        node:
        - RegisteredNode
        -
        pod:

Uses Cases

Inclusion	Exclusion	Results
Empty	Empty	Kubernetes Events related to all namespaces are alerted.
Not set	Some filter	All Kubernetes Events except those namespaces that match the exclusion filter
Some filter	Empty	Kubernetes Events related to all namespaces are alerted.
Some filter	Some filter	All Kubernetes Events except those that match the exclusion filter, plus excluded namespace related events that match the inclusion filter

Given a cluster with three namespaces: logging, monitoring, and testing. The following are a few scenarios for Kubernetes events alert filtering.

For monitoring kubernetes events

Use Case Filtering Rules

Monitor single namespace monitoring

Use Case	Filtering Rules
Monitor single namespace monitoring	`filters: namespace: include: - ^monitoring$ exclude: - .* pod: include: - ^monitoring$ exclude: - ^monitoring$`
Monitor everything except namespace logging	`filters: namespace: exclude: - ^logging$ pod: include: - ^monitoring$ exclude: - ^monitoring$`
Do not monitor namespaces monitoring and logging	`filters: namespace: exclude: - ^logging$ - ^monitoring$ pod: include: - ^monitoring$ exclude: - ^monitoring$`

    filters:
      namespace:
        include:
          - ^monitoring$
        exclude:
          - .*
      pod: 
        include: 
          - ^monitoring$ 
        exclude: 
          - ^monitoring$

Monitor everything except namespace logging

    filters:
      namespace:
        exclude:
          - ^logging$
      pod: 
        include: 
          - ^monitoring$ 
        exclude: 
          - ^monitoring$

Do not monitor namespaces monitoring and logging

    filters:
      namespace:
        exclude:
          - ^logging$
          - ^monitoring$
      pod: 
        include: 
          - ^monitoring$ 
        exclude: 
          - ^monitoring$

Example of configmap

    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: kube-events
      labels:
        name: kube-events
      namespace: opsramp-agent
    data:
      eventsConfig.yaml: |
        filters:
          namespace:
            include:
              - ^acme$
            exclude:
              - .*  
          pod: 
            include: 
              - ^monitoring$ 
            exclude: 
              - ^monitoring$
        node:
        - RegisteredNode
        - RemovingNode
        - DeletingNode
        - TerminatingEvictedPod
        - NodeReady
        - NodeNotReady