Kubernetes Events Filtering

By default, OpsRamp agents notify Kubernetes events for all namespaces. This behavior can be modified, and custom rules can be defined to alert on events relating to specific namespaces. In addition to namespace filtering, you can also define custom rules on pod level events within the namespace by using “include or exclude” filters.

To monitor Kuberenetes events according to defined rules, the filters attribute should be added to the Opsramp agent’s kube-events configMap.

Include and exclude accepts a list of regular expressions.

Filter

    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: kube-events
      labels:
        name: kube-events
      namespace: opsramp-agent
    data:
      eventsConfig.yaml: |
        filters:
          namespace:
            include:
              -
            exclude:  
              -
          pod: 
            include: 
              -  
            exclude: 
              -      
        node:
        - RegisteredNode
        -
        pod:

Uses Cases

Inclusion	Exclusion	Results
Empty	Empty	Kubernetes Events related to all namespaces gets alerted
Not set	Some filter	All Kubernetes Events except those namespaces that match the exclusion filter
Some filter	Empty	Kubernetes Events related to all namespaces gets alerted
Some filter	Some filter	All Kubernetes Events except those that match the exclusion filter, plus excluded namespace related events that match the inclusion filter

Given a cluster with three namespaces: logging, monitoring, and testing, here are some scenarios for kubernetes events alert filtering.

For monitoring kubernetes events

Use Case Filtering Rules

Monitor single namespace monitoring

Use Case	Filtering Rules
Monitor single namespace monitoring	`filters: namespace: include: - ^monitoring$ exclude: - .* pod: include: - ^monitoring$ exclude: - ^monitoring$`
Monitor everything except namespace logging	`filters: namespace: exclude: - ^logging$ pod: include: - ^monitoring$ exclude: - ^monitoring$`
Do not monitor namespaces monitoring and logging	`filters: namespace: exclude: - ^logging$ - ^monitoring$ pod: include: - ^monitoring$ exclude: - ^monitoring$`

    filters:
      namespace:
        include:
          - ^monitoring$
        exclude:
          - .*
      pod: 
        include: 
          - ^monitoring$ 
        exclude: 
          - ^monitoring$

Monitor everything except namespace logging

    filters:
      namespace:
        exclude:
          - ^logging$
      pod: 
        include: 
          - ^monitoring$ 
        exclude: 
          - ^monitoring$

Do not monitor namespaces monitoring and logging

    filters:
      namespace:
        exclude:
          - ^logging$
          - ^monitoring$
      pod: 
        include: 
          - ^monitoring$ 
        exclude: 
          - ^monitoring$

Example of configmap

    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: kube-events
      labels:
        name: kube-events
      namespace: opsramp-agent
    data:
      eventsConfig.yaml: |
        filters:
          namespace:
            include:
              - ^acme$
            exclude:
              - .*  
          pod: 
            include: 
              - ^monitoring$ 
            exclude: 
              - ^monitoring$
        node:
        - RegisteredNode
        - RemovingNode
        - DeletingNode
        - TerminatingEvictedPod
        - NodeReady
        - NodeNotReady