Skip to content

feat(kubernetes_events source): add k8s events src#24448

Open
elohmeier wants to merge 18 commits intovectordotdev:masterfrom
elohmeier:k8s-events-source
Open

feat(kubernetes_events source): add k8s events src#24448
elohmeier wants to merge 18 commits intovectordotdev:masterfrom
elohmeier:k8s-events-source

Conversation

@elohmeier
Copy link
Copy Markdown
Contributor

@elohmeier elohmeier commented Jan 6, 2026

Summary

This PR adds a new kubernetes_events source that watches the Kubernetes Events API and emits each event as a Vector log event. This addresses a long-standing feature request and brings Vector closer to feature parity with other observability tools in the Kubernetes ecosystem.

The design is influenced by similar implementations in:

Key features:

  • Watches the modern events.k8s.io/v1 API (not the deprecated core/v1 Event API)
  • Supports namespace filtering, field selectors, and label selectors
  • Filters by event type (Warning, Normal), reason, and involved object kind
  • Built-in deduplication to handle Kubernetes event replay on API reconnection
  • Configurable max event age to skip stale events on startup
  • Optional inclusion of previous event state for change tracking
  • Designed for singleton deployment (one instance per cluster)

We've been using this in Production in various clusters for some weeks now and it has been working fine.

Vector configuration

sources:
  k8s_events:
    type: kubernetes_events
    namespaces:
      - kube-system
      - default
    include_types:
      - Warning
    max_event_age_seconds: 3600

sinks:
  console:
    type: console
    inputs:
      - k8s_events
    encoding:
      codec: json

How did you test this PR?

  • Unit tests for deduplication logic, event timestamping, and filtering
  • Manual testing against a local Kubernetes cluster (kind/minikube)
  • Verified event streaming, reconnection handling, and deduplication behavior

Change Type

  • Bug fix
  • New feature
  • Non-functional (chore, refactoring, docs)
  • Performance

Is this a breaking change?

  • Yes
  • No

Does this PR include user facing changes?

  • Yes. Please add a changelog fragment based on our guidelines.
  • No. A maintainer will apply the no-changelog label to this PR.

References

@elohmeier elohmeier requested review from a team as code owners January 6, 2026 10:45
@github-actions github-actions Bot added domain: sources Anything related to the Vector's sources domain: external docs Anything related to Vector's external, public documentation labels Jan 6, 2026
@maycmlee maycmlee self-assigned this Jan 6, 2026
Copy link
Copy Markdown
Contributor

@maycmlee maycmlee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just some small suggestions!

Comment thread website/cue/reference/components/sources/kubernetes_events.cue Outdated
Comment thread website/cue/reference/components/sources/kubernetes_events.cue Outdated
Comment thread website/cue/reference/components/sources/kubernetes_events.cue Outdated
Comment thread website/cue/reference/components/sources/kubernetes_events.cue Outdated
Comment thread website/cue/reference/components/sources/kubernetes_events.cue Outdated
Comment thread website/cue/reference/components/sources/kubernetes_events.cue Outdated
Comment thread website/cue/reference/components/sources/kubernetes_events.cue Outdated
elohmeier and others added 10 commits January 6, 2026 21:40
…events.cue

Co-authored-by: May Lee <may.lee@datadoghq.com>
…events.cue

Co-authored-by: May Lee <may.lee@datadoghq.com>
…events.cue

Co-authored-by: May Lee <may.lee@datadoghq.com>
Co-authored-by: May Lee <may.lee@datadoghq.com>
Co-authored-by: May Lee <may.lee@datadoghq.com>
Co-authored-by: May Lee <may.lee@datadoghq.com>
Co-authored-by: May Lee <may.lee@datadoghq.com>
Co-authored-by: May Lee <may.lee@datadoghq.com>
Co-authored-by: May Lee <may.lee@datadoghq.com>
Co-authored-by: May Lee <may.lee@datadoghq.com>
@lukasmrtvy
Copy link
Copy Markdown

@maycmlee friendly ping. Possible to merge? Thanks

Copy link
Copy Markdown
Contributor

@maycmlee maycmlee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good for docs! Let me see if someone from eng can review.

@maycmlee
Copy link
Copy Markdown
Contributor

maycmlee commented Feb 5, 2026

@lukasmrtvy someone from eng will review and be in touch. Thanks for opening this PR!

@thomasqueirozb thomasqueirozb added source: new Request or implementation of a new source platform: kubernetes Anything `kubernetes` platform related labels Feb 17, 2026
@Smana
Copy link
Copy Markdown

Smana commented Mar 6, 2026

@maycmlee are there any news for the PR please? thank you

@maycmlee
Copy link
Copy Markdown
Contributor

@Smana sorry for the delayed response! I'm checking in with the eng team again.

@pront
Copy link
Copy Markdown
Member

pront commented Mar 17, 2026

@codex review

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e04ba0a88

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/sources/kubernetes_events/mod.rs Outdated
@dm3ch
Copy link
Copy Markdown

dm3ch commented Apr 21, 2026

@maycmlee / maintainers — what's the status of this PR from an engineering perspective?
Is there anything blocking a review, or specific concerns about accepting a new kubernetes source?
Happy to help move this forward if there's something concrete I can do.

@elohmeier great work on this. Do you have plans to extend it with leader election
(Lease-based, so it's safe to run with replicas > 1) and some form of checkpoint
to avoid duplicate events on restart or leader change — either here or in a follow-up PR?

I'd like to add both, but unsure whether to wait your PR merge, build on top of this PR or do it separately.
Wanted to check your intentions first before starting planning anything on my own.

@maycmlee
Copy link
Copy Markdown
Contributor

@maycmlee / maintainers — what's the status of this PR from an engineering perspective?
Is there anything blocking a review, or specific concerns about accepting a new kubernetes source?
Happy to help move this forward if there's something concrete I can do.

Looping in @pront to address your questions. Thanks!

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ccd00532ff

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/sources/kubernetes_events/mod.rs Outdated
Comment thread src/sources/kubernetes_events/mod.rs Outdated
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e58987167

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/sources/kubernetes_events/mod.rs Outdated
@elohmeier
Copy link
Copy Markdown
Contributor Author

I'm grateful for the interest in this PR.
@dm3ch thanks for your suggestions. I've implemented leader election and tested it in a K8S cluster. I would leave the checkpoint out of this PR as it is more controversial on how to store the state, but I think it should be implemented.

currently fixing the open codex issues

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6616b0ca26

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/sources/kubernetes_events/mod.rs Outdated
Comment thread src/sources/kubernetes_events/mod.rs Outdated
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 447ed29457

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/sources/kubernetes_events/mod.rs Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

domain: external docs Anything related to Vector's external, public documentation domain: sources Anything related to the Vector's sources platform: kubernetes Anything `kubernetes` platform related source: new Request or implementation of a new source work in progress

Projects

None yet

Development

Successfully merging this pull request may close these issues.

New kubernetes_system_events source

7 participants