whizard-events
Use when working with WizTelemetry Events extension for KubeSphere, including installation, configuration, and event query API
它会碰到什么
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
WizTelemetry Events
Overview
WizTelemetry Events is an extension component in the KubeSphere Observability Platform for Kubernetes event collection, processing, and storage.
When to Use
- Installing or configuring the WizTelemetry Events extension
- Understanding event collection architecture
- Using the event query API to query events
Components
| Component | Description | Default Enabled |
|-----------|-------------|-----------------|
| kube-events-exporter | Kubernetes event collection and export | true |
Dependencies
- WizTelemetry Platform Service (whizard-telemetry): Required
- WizTelemetry Data Pipeline (vector): Required
- OpenSearch (opensearch): Required
Installation
Prerequisites
REQUIRED: Complete all steps in order before generating InstallPlan.
Step 1: Get Available Clusters and Confirm Target
⚠️ CRITICAL: DO NOT proceed until target clusters are determined.
Step 1.1: Get available clusters
kubectl get clusters -o jsonpath='{.items[*].metadata.name}'
Step 1.2: Determine target clusters
- If user explicitly specified target clusters in the request → Use those clusters directly, proceed to Step 2
- If user did NOT specify target clusters → Ask user to confirm which clusters to deploy to, then proceed to Step 2
Ask user (if not specified):
Available clusters: host, dev
Which clusters do you want to deploy WizTelemetry Events to?
Step 2: Get Latest Version (if not provided by user)
MUST do this to get the latest version:
kubectl get extensionversions -l kubesphere.io/extension-ref=whizard-events -o jsonpath='{range .items[*]}{.spec.version}{"\n"}{end}' | sort -V | tail -1
This outputs the latest version (e.g., 1.4.0). Note this down - you'll use it in the InstallPlan.
Install WizTelemetry Events
⚠️ IMPORTANT: Complete prerequisite steps BEFORE this step.
Based on your selections:
- Target clusters: User-confirmed cluster names
⚠️ CRITICAL: InstallPlan metadata.name MUST be whizard-events. DO NOT use any other name.
⚠️ CRITICAL: config field is YAML format. You MUST:
- Use the config structure exactly as shown in the template
- DO NOT add configuration fields that are not shown in the template
- DO NOT modify the structure or hierarchy
⚠️ CRITICAL: All placeholders MUST be replaced with actual values. DO NOT leave them as placeholders.
Template
apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
name: whizard-events
spec:
extension:
name: whizard-events
version: <VERSION> # From Step 2
enabled: true
upgradeStrategy: Manual
clusterScheduling:
placement:
clusters:
- <TARGET_CLUSTERS>
Replace placeholders:
<VERSION>: From Step 2 (e.g.,1.4.0)<TARGET_CLUSTERS>: User-confirmed cluster names
Note: OpenSearch sink configuration (endpoints, auth) is provided by the vector extension. Make sure vector is installed and configured with OpenSearch before installing events.
Enable ISM Policy
apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
name: whizard-events
namespace: kubesphere-system
spec:
extension:
name: whizard-events
version: <VERSION> # From Step 2
enabled: true
upgradeStrategy: Manual
config: |
kube-events-exporter:
sinks:
opensearch:
enabled: true
index:
prefix: "{{ .cluster }}-events"
timestring: "%Y.%m.%d"
ism_policy:
enable: true
min_index_age: "7d"
clusterScheduling:
placement:
clusters:
- <TARGET_CLUSTERS>
Configuration Parameters
OpenSearch Sink Parameters
| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| kube-events-exporter.sinks.opensearch.enabled | bool | true | Enable OpenSearch sink |
| kube-events-exporter.sinks.opensearch.index.prefix | string | "{{ .cluster }}-events" | Index prefix |
| kube-events-exporter.sinks.opensearch.index.timestring | string | "%Y.%m.%d" | Index time format |
ISM Policy Parameters
| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| kube-events-exporter.ism_policy.enable | bool | false | Enable Index State Management policy |
| kube-events-exporter.ism_policy.min_index_age | string | "7d" | Minimum index retention period |
Event Query API
Query Events
curl -X GET "http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.kubesphere.io/v1alpha2/events?operation=query&sort=desc&size=10&cluster=host" \
-H "X-Remote-User: admin"
Query Parameters:
| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| operation | string | query | Operation type: query/statistics/histogram/export |
| workspace_filter | string | | Comma-separated list of workspaces |
| workspace_search | string | | Fuzzy match workspace names |
| involved_object_namespace_filter | string | | Comma-separated list of namespaces (involvedObject.namespace) |
| involved_object_namespace_search | string | | Fuzzy match namespace names |
| involved_object_name_filter | string | | Comma-separated list of object names |
| involved_object_name_search | string | | Fuzzy match object names |
| involved_object_kind_filter | string | | Comma-separated list of kinds |
| reason_filter | string | | Comma-separated list of reasons |
| reason_search | string | | Fuzzy match reason |
| message_search | string | | Fuzzy match message |
| type_filter | string | | Event type: Warning/Normal |
| start_time | string | | Start time (seconds since epoch) |
| end_time | string | | End time (seconds since epoch) |
| interval | string | 15m | Time interval for histogram |
| sort | string | desc | Sort order: asc/desc |
| from | int | 0 | Offset |
| size | int | 10 | Number of results |
| cluster | string | host | Cluster name |
Extension Operations
Check Extension Status
kubectl get installplan whizard-events
kubectl get extensionversions -l kubesphere.io/extension-ref=whizard-events
Uninstall Extension
Uninstall from all clusters:
kubectl delete installplan whizard-events
Uninstall from specific cluster:
To remove WizTelemetry Events from a specific cluster, update the InstallPlan by removing that cluster from clusterScheduling.placement.clusters:
apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
name: whizard-events
spec:
extension:
name: whizard-events
version: <VERSION>
enabled: true
upgradeStrategy: Manual
clusterScheduling:
placement:
clusters:
- <REMAINING_CLUSTERS> # Remove the cluster you want to uninstall from想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。