@W-24431985: Watch Events with an unstructured informer so events.k8s.io/v1 fields are not dropped

[venkatramreddykunta]

Problem

Some API servers serve Events on /api/v1/events with apiVersion: v1 but only the events.k8s.io/v1 field names (regarding, note, deprecatedCount, deprecatedFirstTimestamp, deprecatedLastTimestamp, deprecatedSource). One example is a read-only proxy that stores events.k8s.io/v1 Events.

Sloop watches Events with a typed corev1.Event informer. Decoding into corev1.Event silently drops every one of those fields. The Event is stored like this:

{"involvedObject": {}, "count": null, "firstTimestamp": null, "lastTimestamp": null, "message": null, "source": {}}

updateEventCountTable then skips it because the count is 0, and it has no involved object to attach to. The result is that the EventHeatMap shows no Events for any resource, and there is no error or log line.

Fix

• Watch Events with a dynamic (unstructured) informer on {"", "v1", "events"}, so unknown fields are kept.
• normalizeEvent copies the events.k8s.io/v1 values into the core/v1 fields only when those fields are missing:
  • regarding → involvedObject
  • note → message
  • deprecatedSource → source
  • reportingController → reportingComponent
  • deprecatedCount → count
  • deprecatedFirstTimestamp / deprecatedLastTimestamp → firstTimestamp / lastTimestamp
  • fallbacks: series.count, series.lastObservedTime, eventTime
• Normal core/v1 Events (they already have involvedObject) are returned unchanged. The informer cache object is never modified; a copy is returned.
• processUpdate uses meta.Accessor instead of a reflect lookup. The reflect lookup panicked when logging an excluded unstructured object.
• makeRestConfig is shared by the typed client and the new MakeDynamicClient, so both use the same kubeconfig, context and QPS settings.

Tests

pkg/sloop/ingress/eventnormalize_test.go:

• Test_typedEventDecodeDropsEventsV1Fields reproduces the bug: decoding into corev1.Event gives an empty involvedObject and a count of 0.
• Test_normalizeEvent_* cover the events.k8s.io/v1 shape, an unchanged core/v1 Event, the input not being modified, series/eventTime, and a single eventTime.
• Test_processUpdate_EventsV1Event and Test_processUpdate_ExcludedUnstructured: the second is the regression test for the reflect panic.
• Test_bigPictureEventsV1Event runs end to end with a fake dynamic client and checks that the Event reaches the out channel in core/v1 shape.

Local checks: go vet ./..., go test -race ./..., go mod tidy (no diff), goimports (no new findings), go build ./pkg/sloop/main.go.

Manual before/after against a stub API server that serves events.k8s.io/v1 shaped Events: evidence in a comment below.

Compatibility

• Stored Event payloads now include apiVersion and kind. The events.k8s.io/v1 fields are kept next to the copied core/v1 fields.
• Events that were already stored with empty fields are not backfilled.
• NewKubeWatcherSource takes an extra dynamic.Interface argument.
• Clusters that serve normal core/v1 Events see no change in stored data.

[venkatramreddykunta]

PTAL investigation docs

[venkatramreddykunta]

[venkatramreddykunta]

[venkatramreddykunta]

Closing this for now. The root cause is in the upstream API we point Sloop at: it serves Events in events.k8s.io/v1 shape on the core /api/v1/events endpoint, so fields like involvedObject, message and count came back empty. Sloop's core/v1 Event handling is correct for a standard kube-apiserver, so this isn't a Sloop bug.

We're fixing it on the API side instead, so every client gets core/v1 Events and not only Sloop. Thanks for the review. Happy to reopen if a Sloop-side change turns out to be useful.