{ "componentChunkName": "component---src-templates-issues-tsx", "path": "/issues/341", "result": {"data":{"issuesJson":{"id":"0e1374dc-a8ad-5b68-bb95-93f656fe3795","title":"robusta-dev/kubewatch: 监控 k8s 事件并触发相应的处理器","number":341,"bodyHTML":"
\n



\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Reposrobusta-dev/kubewatch
Views\"views\"
Stars\"stars\"
Forks\"forks\"
License\"license\"
UpdatedAt\"last-commit\"
CreatedAt\"create-at\"
\n\n

\"\"

\n\n
\n
\n

This is the official Kubewatch project, originally by Bitnami, now maintained by Robusta.dev.

\n

Feel free to open issues, raise PRs or talk with us on Slack!

\n

kubewatch is a Kubernetes watcher that publishes notification to available collaboration hubs/notification channels. Run it in your k8s cluster, and you will get event notifications through webhooks.

\n

See the blog post on KubeWatch 2.0 to learn more about how KubeWatch is used.

\n\n

\"GoDoc\" \"License\"
\n\"slack

\n
\n

Fine-Grained Resource Tracking

\n

KubeWatch tracks all changes to Kubernetes resources of given types.

\n

If you need fine-grained filtering of which changes are forwarded, you can use KubeWatch in conjunction with Robusta.

\n

For more details, refer to the Robusta docs on change-tracking.

\n

A diagram showing the two options is shown below. The flow that only uses KubeWatch is purple and the flow that adds Robusta is green.

\n

\"image\"

\n

Latest image

\n
robustadev/kubewatch:v2.9.0\n
\n

Usage

\n
$ kubewatch -h\n\nKubewatch: A watcher for Kubernetes\n\nkubewatch is a Kubernetes watcher that publishes notifications\nto Slack/hipchat/mattermost/flock channels. It watches the cluster\nfor resource changes and notifies them through webhooks.\n\nsupported webhooks:\n - slack\n - slackwebhook\n - msteams\n - hipchat\n - mattermost\n - flock\n - webhook\n - cloudevent\n - smtp\n\nUsage:\n  kubewatch [flags]\n  kubewatch [command]\n\nAvailable Commands:\n  config      modify kubewatch configuration\n  resource    manage resources to be watched\n  version     print version\n\nFlags:\n  -h, --help   help for kubewatch\n\nUse \"kubewatch [command] --help\" for more information about a command.\n\n
\n

Install

\n

Cluster Installation

\n

Using helm:

\n

When you have helm installed in your cluster, use the following setup:

\n
helm repo add robusta https://robusta-charts.storage.googleapis.com && helm repo update\nhelm install kubewatch robusta/kubewatch --set='rbac.create=true,slack.channel=#YOUR_CHANNEL,slack.token=xoxb-YOUR_TOKEN,resourcesToWatch.pod=true,resourcesToWatch.daemonset=true'
\n

You may also provide a values file instead:

\n
rbac:\n  create: true\n  customRoles:\n    - apiGroups: [\"monitoring.coreos.com\"]\n      resources: [\"prometheusrules\"]\n      verbs: [\"get\", \"list\", \"watch\"]\nresourcesToWatch:\n  deployment: false\n  replicationcontroller: false\n  replicaset: false\n  daemonset: false\n  services: true\n  pod: true\n  job: false\n  node: false\n  clusterrole: true\n  clusterrolebinding: true\n  serviceaccount: true\n  persistentvolume: false\n  namespace: false\n  secret: false\n  configmap: false\n  ingress: false\n  coreevent: false\n  event: true\ncustomresources:\n  - group: monitoring.coreos.com\n    version: v1\n    resource: prometheusrules\nslack:\n  channel: '#YOUR_CHANNEL'\n  token: 'xoxb-YOUR_TOKEN'
\n

And use that:

\n
$ helm upgrade --install kubewatch robusta/kubewatch --values=values-file.yml
\n

Using kubectl:

\n

In order to run kubewatch in a Kubernetes cluster quickly, the easiest way is for you to create a ConfigMap to hold kubewatch configuration.

\n

An example is provided at kubewatch-configmap.yaml, do not forget to update your own slack channel and token parameters. Alternatively, you could use secrets.

\n

Create k8s configmap:

\n
$ kubectl create -f kubewatch-configmap.yaml
\n

Create the Pod directly, or create your own deployment:

\n
$ kubectl create -f kubewatch.yaml
\n

A kubewatch container will be created along with kubectl sidecar container in order to reach the API server.

\n

Once the Pod is running, you will start seeing Kubernetes events in your configured Slack channel. Here is a screenshot:

\n

\"slack\"

\n

To modify what notifications you get, update the kubewatch ConfigMap and turn on and off (true/false) resources or configure any resource of your choosing with customresources (CRDs):

\n
resource:\n  deployment: false\n  replicationcontroller: false\n  replicaset: false\n  daemonset: false\n  services: true\n  pod: true\n  job: false\n  node: false\n  clusterrole: false\n  clusterrolebinding: false\n  serviceaccount: false\n  persistentvolume: false\n  namespace: false\n  secret: false\n  configmap: false\n  ingress: false\n  coreevent: false\n  event: true\ncustomresources:\n  - group: monitoring.coreos.com\n    version: v1\n    resource: prometheusrules\n
\n

Working with RBAC

\n

Kubernetes Engine clusters running versions 1.6 or higher introduced Role-Based Access Control (RBAC). We can create ServiceAccount for it to work with RBAC.

\n
$ kubectl create -f kubewatch-service-account.yaml
\n

If you do not have permission to create it, you need to become an admin first. For example, in GKE you would run:

\n
$ kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --user=REPLACE_EMAIL_HERE\n
\n

Edit kubewatch.yaml, and create a new field under spec with serviceAccountName: kubewatch, you can achieve this by running:

\n
$ sed -i '/spec:/a\\ \\ serviceAccountName: kubewatch' kubewatch.yaml
\n

Then just create pod as usual with:

\n
$ kubectl create -f kubewatch.yaml
\n

Working with CRDs

\n

kubewatch can be configured to monitor Kubernetes Custom Resource Definitions (CRDs), allowing you to receive notifications when changes occur.
\nTo configure kubewatch to watch custom resources, you need to define the customresources section either in your values file or by using the --set flag with Helm commands.

\n

Include the custom resource configuration in your values file:

\n
customresources:\n  - group: monitoring.coreos.com\n    version: v1\n    resource: prometheusrules
\n

Then deploy or upgrade kubwatch with helm upgrade or helm install

\n

Alternatively, you can pass this configuration directly using the --set flag:

\n
helm install kubewatch robusta/kubewatch --set='rbac.create=true,slack.channel=#YOUR_CHANNEL,slack.token=xoxb-YOUR_TOKEN,resourcesToWatch.pod=true,resourcesToWatch.daemonset=true,customresources[0].group=monitoring.coreos.com,customresources[0].version=v1,customresources[0].resource=prometheusrules'
\n

Custom RBAC roles

\n

After defining custom resources, make sure that kubewatch has the necessary RBAC permissions to access the custom resources you've configured. Without the appropriate permissions, kubewatch will not be able to monitor your custom resources, and you won't receive notifications for changes.

\n

To grant these permissions, you can define custom RBAC roles using customRoles within the rbac section of your values file or by using the --set flag with Helm commands. This allows you to specify exactly which API groups, resources, and actions kubewatch should have access to.

\n

Here’s how you can configure the necessary permissions to monitor your resources:

\n
rbac:\n  create: true \n  customRoles:\n    - apiGroups: [\"monitoring.coreos.com\"]\n      resources: [\"prometheusrules\"]\n      verbs: [\"get\", \"list\", \"watch\"]
\n

Then deploy or upgrade kubwatch with helm upgrade or helm install

\n

Alternatively, you can pass this configuration directly using the --set flag:

\n
helm install kubewatch robusta/kubewatch --set='rbac.create=true,slack.channel=#YOUR_CHANNEL,slack.token=xoxb-YOUR_TOKEN,customRoles[0].apiGroups={monitoring.coreos.com},customRoles[0].resources={prometheusrules},customRoles[0].verbs={get,list,watch}'
\n

Metrics

\n

kubewatch runs a Prometheus metrics endpoint at /metrics on port 2112 by default. This endpoint can be used to monitor health and the performance of kubewatch.

\n

The kubewatch_events_total metric can help track the total number of Kubernetes events, categorized by resource type (e.g., Pods, Deployments) and event type (e.g., Create, Delete).

\n

You can change the default port (2112) on which the metrics server listens by setting the LISTEN_ADDRESS environment variable.
\nFormat is host:port. :5454 means any host, and port 5454

\n
extraEnvVars:\n  - name: LISTEN_ADDRESS\n    value: \":5454\"
\n

Local Installation

\n

Using go package installer:

\n
# Download and install kubewatch\n$ go get -u github.com/robusta-dev/kubewatch\n\n# Configure the notification channel\n$ kubewatch config add slack --channel <slack_channel> --token <slack_token>\n\n# Add resources to be watched\n$ kubewatch resource add --po --svc\nINFO[0000] resource svc configured\nINFO[0000] resource po configured\n\n# start kubewatch server\n$ kubewatch\nINFO[0000] Starting kubewatch controller                 pkg=kubewatch-service\nINFO[0000] Starting kubewatch controller                 pkg=kubewatch-pod\nINFO[0000] Processing add to service: default/kubernetes  pkg=kubewatch-service\nINFO[0000] Processing add to service: kube-system/tiller-deploy  pkg=kubewatch-service\nINFO[0000] Processing add to pod: kube-system/tiller-deploy-69ffbf64bc-h8zxm  pkg=kubewatch-pod\nINFO[0000] Kubewatch controller synced and ready         pkg=kubewatch-service\nINFO[0000] Kubewatch controller synced and ready         pkg=kubewatch-pod\n
\n

Using Docker:

\n

To Run Kubewatch Container interactively, place the config file in $HOME/.kubewatch.yaml location and use the following command.

\n
docker run --rm -it --network host -v $HOME/.kubewatch.yaml:/root/.kubewatch.yaml -v $HOME/.kube/config:/opt/bitnami/kubewatch/.kube/config --name <container-name> robustadev/kubewatch\n
\n

Example:

\n
$ docker run --rm -it --network host -v $HOME/.kubewatch.yaml:/root/.kubewatch.yaml -v $HOME/.kube/config:/opt/bitnami/kubewatch/.kube/config --name kubewatch-app robustadev/kubewatch\n\n==> Writing config file...\nINFO[0000] Starting kubewatch controller                 pkg=kubewatch-service\nINFO[0000] Starting kubewatch controller                 pkg=kubewatch-pod\nINFO[0000] Starting kubewatch controller                 pkg=kubewatch-deployment\nINFO[0000] Starting kubewatch controller                 pkg=kubewatch-namespace\nINFO[0000] Processing add to namespace: kube-node-lease  pkg=kubewatch-namespace\nINFO[0000] Processing add to namespace: kube-public      pkg=kubewatch-namespace\nINFO[0000] Processing add to namespace: kube-system      pkg=kubewatch-namespace\nINFO[0000] Processing add to namespace: default          pkg=kubewatch-namespace\n....\n
\n

To Demonise Kubewatch container use

\n
$ docker run --rm -d --network host -v $HOME/.kubewatch.yaml:/root/.kubewatch.yaml -v $HOME/.kube/config:/opt/bitnami/kubewatch/.kube/config --name kubewatch-app robustadev/kubewatch\n
\n

Configure

\n

Kubewatch supports config command for configuration. Config file will be saved at $HOME/.kubewatch.yaml

\n
$ kubewatch config -h\n\nconfig command allows admin setup his own configuration for running kubewatch\n\nUsage:\n  kubewatch config [flags]\n  kubewatch config [command]\n\nAvailable Commands:\n  add         add webhook config to .kubewatch.yaml\n  test        test handler config present in .kubewatch.yaml\n  view        view .kubewatch.yaml\n\nFlags:\n  -h, --help   help for config\n\nUse \"kubewatch config [command] --help\" for more information about a command.\n
\n

Example:

\n

slack:

\n\n

slackwebhookurl:

\n\n
$ cat kubewatch-configmap-slackwebhook.yaml | sed \"s|<slackchannel>|\"\\\"$SlackChannel\"\\\"|g;s|<slackusername>|\"\\\"$SlackUsesrName\"\\\"|g;s|<slackemoji>|\"\\\"$SlackEmoji\"\\\"|g;s|<SlackWebhookUrl>|\"\\\"$WebhookUrl\"\\\"|g\" | kubectl create -f -
\n\n
apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: kubewatch\ndata:\n .kubewatch.yaml: |\n   namespace: \"\"\n   handler:\n     slackwebhook:\n       enabled: true\n       channel: <slackchannel>\n       username: <slackusername>\n       emoji: <slackemoji>\n       slackwebhookurl: <SlackWebhookUrl>\n   resource:\n     clusterrole: false\n     configmap: false\n     daemonset: false\n     deployment: true\n     ingress: false\n     job: false\n     namespace: false\n     node: false\n     persistentvolume: false\n     pod: true\n     replicaset: false\n     replicationcontroller: false\n     secret: false\n     serviceaccount: false\n     services: true\n     event: true\n     coreevent: false\n   ```\n\n### flock:\n\n- Create a [flock bot](https://docs.flock.com/display/flockos/Bots).\n\n- Add flock webhook url to config using the following command.\n ```console\n $ kubewatch config add flock --url <flock_webhook_url>
\n

You have an altenative choice to set your FLOCK URL

\n
$ export KW_FLOCK_URL='https://api.flock.com/hooks/sendMessage/XXXXXXXX'
\n

Testing Config

\n

To test the handler config by send test messages use the following command.

\n
$ kubewatch config test -h\n\nTests handler configs present in .kubewatch.yaml by sending test messages\n\nUsage:\n  kubewatch config test [flags]\n\nFlags:\n  -h, --help   help for test\n
\n

Example:

\n
$ kubewatch config test\n\nTesting Handler configs from .kubewatch.yaml\n2019/06/03 12:29:23 Message successfully sent to channel ABCD at 1559545162.000100\n
\n

Viewing config

\n

To view the entire config file $HOME/.kubewatch.yaml use the following command.

\n
$ kubewatch config view\nContents of .kubewatch.yaml\n\nhandler:\n  slack:\n    token: xoxb-xxxxx-yyyy-zzz\n    channel: kube-watch\n  hipchat:\n    token: \"\"\n    room: \"\"\n    url: \"\"\n  mattermost:\n    channel: \"\"\n    url: \"\"\n    username: \"\"\n  flock:\n    url: \"\"\n  webhook:\n    url: \"\"\n  cloudevent:\n    url: \"\"\nresource:\n  deployment: false\n  replicationcontroller: false\n  replicaset: false\n  daemonset: false\n  services: false\n  pod: true\n  job: false\n  node: false\n  clusterrole: false\n  clusterrolebinding: false\n  serviceaccount: false\n  persistentvolume: false\n  namespace: false\n  secret: false\n  configmap: false\n  ingress: false\n  event: true\n  coreevent: false\nnamespace: \"\"\n\n
\n

Resources

\n

To manage the resources being watched, use the following command, changes will be saved to $HOME/.kubewatch.yaml.

\n
$ kubewatch resource -h\n\nmanage resources to be watched\n\nUsage:\n  kubewatch resource [flags]\n  kubewatch resource [command]\n\nAvailable Commands:\n  add         adds specific resources to be watched\n  remove      remove specific resources being watched\n\nFlags:\n      \n      --clusterrolebinding      watch for cluster role bindings\n      --clusterrole             watch for cluster roles\n      --cm                      watch for plain configmaps\n      --deploy                  watch for deployments\n      --ds                      watch for daemonsets\n  -h, --help                    help for resource\n      --ing                     watch for ingresses\n      --job                     watch for jobs\n      --node                    watch for Nodes\n      --ns                      watch for namespaces\n      --po                      watch for pods\n      --pv                      watch for persistent volumes\n      --rc                      watch for replication controllers\n      --rs                      watch for replicasets\n      --sa                      watch for service accounts\n      --secret                  watch for plain secrets\n      --svc                     watch for services\n      --coreevent               watch for events from the kubernetes core api. (Old events api, replaced in kubernetes 1.19)\n\nUse \"kubewatch resource [command] --help\" for more information about a command.\n\n
\n

Add/Remove resource:

\n
$ kubewatch resource add -h\n\nadds specific resources to be watched\n\nUsage:\n  kubewatch resource add [flags]\n\nFlags:\n  -h, --help   help for add\n\nGlobal Flags:\n      --clusterrole             watch for cluster roles\n      --clusterrolebinding      watch for cluster role bindings\n      --cm                      watch for plain configmaps\n      --deploy                  watch for deployments\n      --ds                      watch for daemonsets\n      --ing                     watch for ingresses\n      --job                     watch for jobs\n      --node                    watch for Nodes\n      --ns                      watch for namespaces\n      --po                      watch for pods\n      --pv                      watch for persistent volumes\n      --rc                      watch for replication controllers\n      --rs                      watch for replicasets\n      --sa                      watch for service accounts\n      --secret                  watch for plain secrets\n      --svc                     watch for services\n      --coreevent               watch for events from the kubernetes core api. (Old events api, replaced in kubernetes 1.19)\n\n
\n

Example:

\n
# rc, po and svc will be watched\n$ kubewatch resource add --rc --po --svc\n\n# rc, po and svc will be stopped from being watched\n$ kubewatch resource remove --rc --po --svc
\n

Changing log level

\n

In case you want to change the default log level, add an environment variable named LOG_LEVEL with value from trace/debug/info/warning/error

\n
env:\n- name: LOG_LEVEL\n  value: debug
\n

Changing log format

\n

In case you want to change the log format to json, add an environment variable named LOG_FORMATTER with value json

\n
env:\n- name: LOG_FORMATTER\n  value: json
\n

Build

\n

Using go

\n

Clone the repository anywhere:

\n
$ git clone https://github.com/bitnami-labs/kubewatch.git\n$ cd kubewatch\n$ go build
\n

or

\n

You can also use the Makefile directly:

\n
$ make build
\n

Prerequisites

\n\n

Using Docker

\n
$ make docker-image\n$ docker images\nREPOSITORY          TAG                 IMAGE ID            CREATED              SIZE\nkubewatch           latest              919896d3cd90        3 minutes ago       27.9MB
\n

Prerequisites

\n\n

Contribution

\n

Refer to the contribution guidelines to get started.

","updatedAt":"2025-05-21T16:09:36Z","upvoteCount":null,"author":{"login":"eryajf","avatarUrl":"https://avatars.githubusercontent.com/u/33259379?u=e4a4090a38ac2473aaed4ef9945233636776c6c3&v=4","url":"https://github.com/eryajf"},"category":null,"labels":{"edges":[{"node":{"name":"更多","color":"25B472"}},{"node":{"name":"K8S-Tools","color":"2d411a"}},{"node":{"name":"robusta-dev","color":"48cd61"}}]},"comments":{"edges":[]}}},"pageContext":{"number":341,"previous":{"title":"kubewall/kubewall: 一个轻量的 k8s 集群控制面板，一个二进制即可部署，用在本地使用还是不错的。","number":340},"next":{"title":"eip-work/kuboard-press: K8s 多集群管理平台，开源免费版本仅支持3个以内的集群","number":342}}}, "staticQueryHashes": ["151096407","2861350382"]}