WizTelemetry Events

Overview

WizTelemetry Events is an extension component in the KubeSphere Observability Platform for Kubernetes event collection, processing, and storage.

When to Use

• Installing or configuring the WizTelemetry Events extension
• Understanding event collection architecture
• Using the event query API to query events

Components

Dependencies

• WizTelemetry Platform Service (whizard-telemetry): Required
• WizTelemetry Data Pipeline (vector): Required
• OpenSearch (opensearch): Required

Installation

Prerequisites

REQUIRED: Complete all steps in order before generating InstallPlan.

Step 1: Get Available Clusters and Confirm Target

⚠️ CRITICAL: DO NOT proceed until target clusters are determined.

Step 1.1: Get available clusters

kubectl get clusters -o jsonpath='{.items[*].metadata.name}'

Step 1.2: Determine target clusters

• If user explicitly specified target clusters in the request → Use those clusters directly, proceed to Step 2
• If user did NOT specify target clusters → Ask user to confirm which clusters to deploy to, then proceed to Step 2

Ask user (if not specified):

Available clusters: host, dev
Which clusters do you want to deploy WizTelemetry Events to?

Step 2: Get Latest Version (if not provided by user)

MUST do this to get the latest version:

kubectl get extensionversions -n kubesphere-system -l kubesphere.io/extension-ref=whizard-events -o jsonpath='{range .items[*]}{.spec.version}{"\n"}{end}' | sort -V | tail -1

This outputs the latest version (e.g.,

1.4.0

Install WizTelemetry Events

⚠️ IMPORTANT: Complete prerequisite steps BEFORE this step.

Based on your selections:

• Target clusters: User-confirmed cluster names

⚠️ CRITICAL: InstallPlan

metadata.name

whizard-events

⚠️ CRITICAL:

config

• Use the config structure exactly as shown in the template
• DO NOT add configuration fields that are not shown in the template
• DO NOT modify the structure or hierarchy

⚠️ CRITICAL: All placeholders MUST be replaced with actual values. DO NOT leave them as placeholders.

Template

apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
  name: whizard-events
  namespace: kubesphere-system
spec:
  extension:
    name: whizard-events
    version: <VERSION>  # From Step 2
  enabled: true
  upgradeStrategy: Manual
  clusterScheduling:
    placement:
      clusters:
        - <TARGET_CLUSTERS>

Replace placeholders:

• <VERSION>

  : From Step 2 (e.g.,

  1.4.0

  )

• <TARGET_CLUSTERS>

  : User-confirmed cluster names

Note: OpenSearch sink configuration (endpoints, auth) is provided by the vector extension. Make sure vector is installed and configured with OpenSearch before installing events.

Enable Doris Sink

To enable Doris sink for events storage:

apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
  name: whizard-events
  namespace: kubesphere-system
spec:
  extension:
    name: whizard-events
    version: <VERSION>  # From Step 2
  enabled: true
  upgradeStrategy: Manual
  config: |
    kube-events-exporter:
      sinks:
        opensearch:
          enabled: true
          index:
            prefix: "{{ .cluster }}-events"
            timestring: "%Y.%m.%d"
        doris:
          enabled: true
          fe: <DORIS_FE>
          be: <DORIS_BE>
          table:
            partitionUnit: DAY
            retentionPartition: 7
            replicationNum: 2
  clusterScheduling:
    placement:
      clusters:
        - <TARGET_CLUSTERS>

Enable ISM Policy

apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
  name: whizard-events
  namespace: kubesphere-system
spec:
  extension:
    name: whizard-events
    version: <VERSION>  # From Step 2
  enabled: true
  upgradeStrategy: Manual
  config: |
    kube-events-exporter:
      sinks:
        opensearch:
          enabled: true
          index:
            prefix: "{{ .cluster }}-events"
            timestring: "%Y.%m.%d"
      ism_policy:
        enable: true
        min_index_age: "7d"
  clusterScheduling:
    placement:
      clusters:
        - <TARGET_CLUSTERS>

Configuration Parameters

OpenSearch Sink Parameters

kube-events-exporter.sinks.opensearch.enabled

kube-events-exporter.sinks.opensearch.index.prefix

kube-events-exporter.sinks.opensearch.index.timestring

Doris Sink Parameters

kube-events-exporter.sinks.doris.enabled

kube-events-exporter.sinks.doris.fe

kube-events-exporter.sinks.doris.be

kube-events-exporter.sinks.doris.table.partitionUnit

kube-events-exporter.sinks.doris.table.retentionPartition

kube-events-exporter.sinks.doris.table.replicationNum

ISM Policy Parameters

kube-events-exporter.ism_policy.enable

kube-events-exporter.ism_policy.min_index_age

Event Query API

Query Events

curl -X GET "http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.kubesphere.io/v1alpha2/events?operation=query&sort=desc&size=10&cluster=host" \
  -H "X-Remote-User: admin"

Query Parameters:

operation

workspace_filter

workspace_search

involved_object_namespace_filter

involved_object_namespace_search

involved_object_name_filter

involved_object_name_search

involved_object_kind_filter

reason_filter

reason_search

message_search

type_filter

start_time

end_time

interval

sort

from

size

cluster

Extension Operations

Check Extension Status

kubectl get installplan -n kubesphere-system -l extension.kubesphere.io/name=whizard-events
kubectl get extensionversions -n kubesphere-system whizard-events

Uninstall Extension

Uninstall from all clusters:

kubectl delete installplan -n kubesphere-system whizard-events

Uninstall from specific cluster:

To remove WizTelemetry Events from a specific cluster, update the InstallPlan by removing that cluster from

clusterScheduling.placement.clusters

apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
  name: whizard-events
  namespace: kubesphere-system
spec:
  extension:
    name: whizard-events
    version: <VERSION>
  enabled: true
  upgradeStrategy: Manual
  clusterScheduling:
    placement:
      clusters:
        - <REMAINING_CLUSTERS>  # Remove the cluster you want to uninstall from