k8s a oublié ses events et lumnik sait encore qui a crashé cette nuit

# A kind cluster that forgets its events after 3 minutes instead of one hour (kube-apiserver --event-ttl):# the same forgetting a production cluster does, sped up so the stand can watch it happen.kind: ClusterapiVersion: kind.x-k8s.io/v1alpha4nodes:  - role: control-plane    kubeadmConfigPatches:      - |        kind: ClusterConfiguration        apiServer:          extraArgs:            event-ttl: 3m

# Three deployments. Each failure is produced by Kubernetes itself, nothing is faked.# payment-api: exits 1 after five seconds — restarted, then CrashLoopBackOff. run.sh repairs it later (lab-20).apiVersion: apps/v1kind: Deploymentmetadata: { name: payment-api, namespace: payments, labels: { team: team-payments } }spec:  replicas: 1  selector: { matchLabels: { app: payment-api } }  template:    metadata: { labels: { app: payment-api, team: team-payments } }    spec:      containers:        - name: api          image: busybox:1.36          command: ["sh", "-c", "sleep 5; exit 1"]---# billing-api: the same crash, never repaired — still in CrashLoopBackOff when the question is asked.apiVersion: apps/v1kind: Deploymentmetadata: { name: billing-api, namespace: billing, labels: { team: team-billing } }spec:  replicas: 1  selector: { matchLabels: { app: billing-api } }  template:    metadata: { labels: { app: billing-api, team: team-billing } }    spec:      containers:        - name: api          image: busybox:1.36          command: ["sh", "-c", "sleep 5; exit 1"]---# catalog-api: healthy from the start, never restarted.apiVersion: apps/v1kind: Deploymentmetadata: { name: catalog-api, namespace: catalog, labels: { team: team-catalog } }spec:  replicas: 1  selector: { matchLabels: { app: catalog-api } }  template:    metadata: { labels: { app: catalog-api, team: team-catalog } }    spec:      containers:        - name: api          image: busybox:1.36          command: ["sh", "-c", "sleep infinity"]

# What lumnik may do in the cluster: read events, cluster-wide. Nothing else.apiVersion: v1kind: Namespacemetadata: { name: lumnik-reader }---apiVersion: v1kind: ServiceAccountmetadata: { name: lumnik-reader, namespace: lumnik-reader }---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata: { name: lumnik-reader }rules:  - apiGroups: [""]    resources: [events]    verbs: [get, list]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata: { name: lumnik-reader }roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: lumnik-reader }subjects: [{ kind: ServiceAccount, name: lumnik-reader, namespace: lumnik-reader }]---# A long-lived token for the hub's connector secret (projected tokens expire within the hour).apiVersion: v1kind: Secretmetadata:  name: lumnik-reader-token  namespace: lumnik-reader  annotations: { kubernetes.io/service-account.name: lumnik-reader }type: kubernetes.io/service-account-token

# The cluster's own API, read-only: its Warning events about pods.# Each run keeps what it read; an event the cluster forgets afterwards stays in the hub.# The token and the CA come from the lumnik-reader ServiceAccount (lab-30-reader.yaml): lm secret set.apiVersion: connectors.lumnik.io/v1kind: Connectormetadata:  name: k8s-events  connector_type: rest-generic  scopes: [devops-event-memory]spec:  base_url: https://kubernetes.default.svc  auth: { kind: bearer, token_env: K8S_READER_TOKEN }  tls: { ca_secret: CLUSTER_CA }  defaults:    incremental: { mode: full }  endpoints:    - id: warnings      method: GET      path: /api/v1/events?fieldSelector=type%3DWarning,involvedObject.kind%3DPod      pagination: { kind: cursor, cursor_param: continue, cursor_path: $.metadata.continue, response_path: $.items }      target:        kind: hybrid        table: connector.k8s_warnings        unique_key: $.metadata.uid        promote:          - { name: event_uid,  path: "$.metadata.uid",            type: text }          - { name: namespace,  path: "$.involvedObject.namespace", type: text }          - { name: pod,        path: "$.involvedObject.name",      type: text }          - { name: reason,     path: "$.reason",                   type: text }          - { name: count,      path: "$.count",                    type: integer }          - { name: first_seen, path: "$.firstTimestamp",           type: timestamptz }          - { name: last_seen,  path: "$.lastTimestamp",            type: timestamptz }          - { name: message,    path: "$.message",                  type: text }          - { name: workload_key, type: text }       # filled by workload-key.kts      mapping:        cell:          - kotlin: { script: hooks:workload-key.kts }

// The deployment an event is about: namespace/deployment. A Deployment's pod is named// <deployment>-<replicaset hash>-<pod suffix>, and a new pod keeps the deployment, not the name.@Suppress("UNCHECKED_CAST")val cells = bindings["cells"] as MutableMap<String, Any?>val deployment = (cells["pod"] as String?)?.split("-")?.dropLast(2)?.joinToString("-")cells["workload_key"] = if (deployment.isNullOrEmpty()) null else "${cells["namespace"]}/$deployment"

# The fix the on-call engineer ships: payment-api stops crashing. A new pod replaces the old one —# Running, 0 restarts — and the old pod's events expire with the cluster's event TTL.apiVersion: apps/v1kind: Deploymentmetadata: { name: payment-api, namespace: payments, labels: { team: team-payments } }spec:  replicas: 1  selector: { matchLabels: { app: payment-api } }  template:    metadata: { labels: { app: payment-api, team: team-payments } }    spec:      containers:        - name: api          image: busybox:1.36          command: ["sh", "-c", "sleep infinity"]

kind: Entityname: KubernetesWarninglabel: Kubernetes Warning event about a pod, kept after the cluster forgot itdescription: "One Warning event the cluster recorded about a pod of a deployment, read from the Kubernetes API and kept by the hub after Kubernetes expired it. reason BackOff means the container crashed and was restarted in a loop; count is how many times it repeated."match: [event_uid]scopes: [devops-event-memory]columns:  event_uid:    { label: "The event's identifier in the cluster" }  workload_key: { label: "namespace/deployment — the deployment whose pod the event is about; it survives the pod" }  pod:          { label: "The pod the event is about; a repaired deployment runs a new pod" }  reason:       { label: "Why Kubernetes warned: BackOff (restarted in a loop), Unhealthy, FailedMount…" }  count:        { label: "How many times this event repeated" }  first_seen:   { label: "When it was first seen" }  last_seen:    { label: "When it was last seen" }  message:      { label: "Kubernetes' own message" }sources:  - table: k8s_warnings    map:      event_uid: event_uid      workload_key: workload_key      pod: pod      reason: reason      count: count      first_seen: first_seen      last_seen: last_seen      message: message