Documentation
¶
Overview ¶
Package alertstate gives KubeAura's alerts a memory.
Rule evaluation in internal/k8s is stateless by design: it reads live cluster state and derives what is wrong right now. That answers "what is broken" but not the two questions an operator actually asks during an incident — "when did this start" and "is this the thing I already looked at". A list of 200 warnings with no answer to either is a wall, not a signal.
The Tracker sits between evaluation and the API and remembers alerts by fingerprint across evaluations: when each was first seen, how long it has been firing, how many evaluations it survived, whether it has been acknowledged, and what stopped firing since last time.
State is in memory and per-process, matching the rest of KubeAura: it is an operator tool, not a monitoring system. Restarting the binary forgets acknowledgements, which is the right trade — a stale ack that outlives the incident is worse than re-acking.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Tracker ¶
type Tracker struct {
// contains filtered or unexported fields
}
Tracker remembers alert state across evaluations, keyed by cluster context so switching contexts does not report one cluster's history against another.
func (*Tracker) Ack ¶
Ack marks an alert as triaged. A zero until means "until it resolves", which is the common case: you looked at it, you know, stop showing it to you until something actually changes.
func (*Tracker) FirstSeen ¶
FirstSeen reports when a fingerprint started firing, for callers correlating an alert against cluster changes. The second return is false when the alert is unknown to the tracker.
func (*Tracker) Observe ¶
func (t *Tracker) Observe(cluster, scope string, rep *k8s.AlertReport) *k8s.AlertReport
Observe records one evaluation and returns the report enriched with temporal state. It mutates rep in place and returns it for convenience.
The scope argument matters: a namespace-scoped evaluation must not conclude that every alert in other namespaces has resolved. Callers pass the namespace they asked for ("" for the whole cluster) and only alerts in that scope are considered for resolution.
Source Files