Collect Kubernetes events in Osuite

Kubernetes emits an event for most cluster activity — pods being scheduled, images pulling, probes failing, nodes going NotReady. The osuite-k8s Helm chart collects these events and sends them to Osuite as a log stream, correlated with the workloads they describe.

How events are collected

Event collection is part of the cluster-wide collector (otel-clusterwide) and is always on — there is no flag to enable it. Installing the chart is enough.

The collector uses the OpenTelemetry k8sobjects receiver. It watches the events.k8s.io API group and, in the same receiver, periodically pulls object snapshots (pods, nodes, namespaces, deployments, replicasets, statefulsets, daemonsets, jobs, cronjobs) so you have current object state alongside the event stream.

k8sobjects:
  auth_type: serviceAccount
  objects:
    - name: events
      group: events.k8s.io
      mode: watch
    - name: pods
      mode: pull
      interval: 10m

Events flow through the collector’s logs pipeline. A transform step sets the log timestamp from the event’s observed time, attaches the cluster and environment values from your values.yaml as resource attributes, and places the parsed event object under a parsedEvent attribute so its fields are queryable in Osuite.

Prerequisites

• The osuite-k8s chart installed — see Kubernetes monitoring. The chart’s ServiceAccount already carries the RBAC needed to watch events.

Verify in Osuite

What you should see

Trigger activity in the cluster — for example, kubectl rollout restart deployment/<name> — and within a minute the corresponding events appear in the logs explorer, scoped to the cluster label you configured.

Because events land as logs, you can filter and search them in the logs explorer, and the Investigation Agent reads them when it correlates an incident with what changed in the cluster.

Troubleshooting

• No events arriving — confirm the otel-clusterwide pod is running (kubectl get pods -n osuite) and that its ServiceAccount was not modified; watching events requires list and watch on the events.k8s.io API group.
• Events but no object snapshots — snapshots are pulled every 10 minutes, so allow that interval after install before assuming they are missing.

No data in Osuite after a few minutes? Work through these checks.

• Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
• Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
• Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
• Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
• Network — confirm the host has outbound access to the ingest endpoint on port 443.
• Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.