How do I get Kubernetes events into an AI SRE?

Tares has no connector of its own for Kubernetes events today, but you have three routes. Forward events as JSON to the webhook connector, poll a JSON endpoint with http_poll, or send them over OpenTelemetry with the otlp connector. Each route turns events into Tares events with labels you choose.

How it works

Pick the route that matches what your cluster already offers.

• Webhook connector. Anything that can send an HTTP request can POST JSON to a Tares ingest URL. Tares stores the payload lossless and maps the fields you declare as labels into the event. Use this when you have a forwarder that posts Kubernetes events as JSON. See the webhook connector.
• http_poll connector. Tares polls any JSON endpoint on a schedule and creates one event per item. The default interval is 5 minutes. You set the url, and can set method, body, headers and a credential. Use this when your events are already available from a JSON endpoint.
• OpenTelemetry (otlp connector). Tares receives OTLP/HTTP logs, traces and metrics. One source ingests every service, and resource attributes such as service.name become labels. Use this when your cluster already exports OTLP, for example through an OpenTelemetry Collector. See the OTLP connector.

Whichever route you choose, labels are how events are grouped. You mark one label as primary, and that is the key your events correlate on.

Set it up

The webhook route is the most direct, so these steps use it.

1. Create a webhook source. In the console, go to Sources, then Add source, then webhook. Or ask a connected agent to create a webhook source keyed by a field from your event payload. The agent calls create_source and returns the ingest URL.
2. Declare a label for each payload field you want to correlate on, and mark one as primary. The webhook source looks like this:

- name: ci-events
  connector: webhook
  config:
    event_type_field: action
    text_template: '{action} by {sender}'
    labels:
      - { name: pipeline, field: pipeline, primary: true }

Replace the field names with fields from your Kubernetes event payload. event_type_field reads the event type from a payload field, text_template renders a readable line from payload fields, and event_time_field names the field that holds an ISO-8601 timestamp. 3. Save, then copy the ingest endpoint from the source page. You can also POST /api/sources with the same object, and the response includes the ingest_key. 4. Point your forwarder at /ingest/ followed by your ingest key. Send one object, a list, or NDJSON. This request shows the shape:

curl -X POST http://localhost:8787/ingest/<ingest_key> \
  -H 'Content-Type: application/json' \
  -d '{"action": "deploy", "sender": "ci", "pipeline": "web"}'

5. On a secured instance (tares up --auth), have the forwarder send an ingest-scoped API key as Authorization: Bearer followed by the key. Creating a push source in the console mints one for it and shows it once.
6. Check the result. Recent events shows what arrives, and Fields shows which payload fields come in and how often, so you can pick a reliable key.

If you take the OpenTelemetry route instead, create an otlp source and point your exporter at Tares:

- name: otel
  connector: otlp
  config:
    labels:
      - { name: service, field: service, primary: true }

OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:8787   # OTLP/HTTP → /v1/{logs,traces,metrics}
# or gRPC (otlp-grpc extra): OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

OTLP/gRPC needs the otlp-grpc extra, and the receiver listens on port 4317. On a secured instance, exporters send the same ingest-scoped key as Authorization: Bearer.

What you get

• Kubernetes events arrive in Tares as events with labels you chose, so your AI SRE can work from them next to your other sources.
• With the webhook connector, the full payload is stored lossless, so fields you did not map stay available.
• With the otlp connector, one source covers every service, and the service label comes from service.name with no per-service setup.
• With http_poll, an endpoint you already have becomes a source on a schedule you set, one event per item.
• You can check each route in Recent events right after the first event arrives.

When something else fits

Choose the route by where your events start.

• If your forwarder posts JSON, use the webhook connector. It is the catch-all for anything that can send an HTTP request.
• If your events sit behind a JSON endpoint that you can read on a schedule, use http_poll. Polling means events arrive on the interval you set, not the moment they happen.
• If your cluster already runs OpenTelemetry, use the otlp connector and keep one pipeline for logs, traces and metrics.

If you need events the moment they happen and your tooling can push, prefer the webhook or OTLP route over polling.

Related