By default, OpsRamp agents notify Kubernetes events for all namespaces. This behavior can be modified, and custom rules can be defined to alert on events relating to specific namespaces.

To monitor Kuberenetes events according to defined rules, the filters attribute should be added to the Opsramp agent’s kube-events configMap.

Include and exclude accepts a list of regular expressions.

Filter

    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: kube-events
      labels:
        name: kube-events
      namespace: opsramp-agent
    data:
      eventsConfig.yaml: |
        filters:
          namespace:
            include:
              -
              -
            exclude:  
              -
        node:
        - RegisteredNode
        -
        pod:

Uses Cases

InclusionExclusionResults
EmptyEmptyKubernetes Events related to all namespaces gets alerted
Not setSome filterAll Kubernetes Events except those namespaces that match the exclusion filter
Some filterEmptyKubernetes Events related to all namespaces gets alerted
Some filterSome filterAll Kubernetes Events except those that match the exclusion filter, plus excluded namespace related events that match the inclusion filter

Given a cluster with three namespaces: logging, monitoring, and testing, here are some scenarios for kubernetes events alert filtering.

For monitoring kubernetes events

Use CaseFiltering Rules
Monitor single namespace monitoring
    filters:
       namespace:
         include:
           - ^monitoring$
         exclude:
           - .*
Monitor everything except namespace logging
    filters:
       namespace:
         exclude:
           - ^logging$
Do not monitor namespaces monitoring and logging
    filters:
        namespace:
          exclude:
            - ^logging$
            - ^monitoring$

Example of configmap

    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: kube-events
      labels:
        name: kube-events
      namespace: opsramp-agent
    data:
      eventsConfig.yaml: |
        filters:
          namespace:
            include:
              - ^acme$
            exclude:
              - .*  
        node:
        - RegisteredNode
        - RemovingNode
        - DeletingNode
        - TerminatingEvictedPod
        - NodeReady
        - NodeNotReady