K3s Events Filtering

By default, OpsRamp agents notify K3s events for all namespaces. This behavior can be modified, and custom rules can be defined to alert on events relating to specific namespaces.

To monitor K3s events according to defined rules, the filters attribute should be added to the Opsramp agent’s kube-events configMap.

Include and exclude accepts a list of regular expressions.

Filter

    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: kube-events
      labels:
        name: kube-events
      namespace: opsramp-agent
    data:
      eventsConfig.yaml: |
        filters:
          namespace:
            include:
              -
              -
            exclude:  
              -
        node:
        - RegisteredNode
        -
        pod:

Uses Cases

Given a cluster with three namespaces: logging, monitoring, and testing, here are some scenarios for kubernetes events alert filtering.

For monitoring K3s events

    filters:
       namespace:
         include:
           - ^monitoring$
         exclude:
           - .*

    filters:
       namespace:
         exclude:
           - ^logging$

    filters:
        namespace:
          exclude:
            - ^logging$
            - ^monitoring$

Example of configmap

    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: kube-events
      labels:
        name: kube-events
      namespace: opsramp-agent
    data:
      eventsConfig.yaml: |
        filters:
          namespace:
            include:
              - ^acme$
            exclude:
              - .*  
        node:
        - RegisteredNode
        - RemovingNode
        - DeletingNode
        - TerminatingEvictedPod
        - NodeReady
        - NodeNotReady