search

robusta-dev / kubewatch

Watch k8s events and trigger Handlers
Apache License 2.0
604 stars 84 forks source link

Is it possible to have save the output of cloudevents to a file? #55

Open patrickdung opened 1 year ago

patrickdung commented 1 year ago

Currently it would sending to other location. Just wonder if it is possible to save it locally.

aantn commented 1 year ago

Hi @patrickdung, You can't save them directly to file with kubewatch. If it helps, Robusta (https://github.com/robusta-dev/robusta) can listen to KubeWatch events and write them to file.

If you provide more details on your use case, I can try and provide better instructions.

patrickdung commented 1 year ago

@aantn

In my organization, the users or developers are the tenants, the just own a namespace without privilege to create CRD and having limited privilege on selected ClusterRoles. So, it is not possible to install Robusta.

I would like to perform monitoring on per namespace basis using RBAC with rights on events (watch, get, listen). Then I would like to save the output from kubewatch to a file and then to other SIEM.

aantn commented 1 year ago

Got it, thanks. We don't support writing directly to file today, but feel free to open a PR. We'd be happy to review.

On Sun, Aug 20, 2023, 05:25 Patrick Dung @.***> wrote:

@aantn https://github.com/aantn

In my organization, the users or developers are the tenants, the just own a namespace without privilege to create CRD and having limited privilege on selected ClusterRoles. So, it is not possible to install Robusta.

I would like to perform monitoring on per namespace basis using RBAC with rights on events (watch, get, listen). Then I would like to save the output from kubewatch to a file and then to other SIEM.

— Reply to this email directly, view it on GitHub https://github.com/robusta-dev/kubewatch/issues/55#issuecomment-1685158000, or unsubscribe https://github.com/notifications/unsubscribe-auth/AADYUBZ2BX6XKBXU4DPYOJ3XWFYTBANCNFSM6AAAAAA25CVNZE . You are receiving this because you were mentioned.Message ID: @.***>