Events
The Kubernetes Events the operator records on its CRs, and how to read them.
The operator records a Kubernetes Event on a CR for every error it hits and
every change of its state, so kubectl describe and kubectl get events
tell a CR's story without the operator's logs. An Event's reason is
always one of the reason codes; its
action is Reconcile, or Cleanup for the finalizer's work when the
CR is deleted.
| When | Type | Reason | Action | Note |
|---|---|---|---|---|
A reconcile ends on Ready: False — every time, not only the first | Warning | the failure's code | Reconcile | the condition's message |
Ready turns True, or stays True with another reason | Normal | Reconciled | Reconcile | the condition's message |
| An advisory condition appears or changes | Normal | NoAccessPolicyBound | Reconcile | its message |
| An advisory condition goes away | Normal | its code | Reconcile | <type> no longer applies: <message> |
| The remote Authentik object was created for this CR. | Normal | Created | Reconcile | what happened, with the remote object's id |
| The finalizer deleted the remote Authentik object of this CR. | Normal | Deleted | Cleanup | what happened, with the remote object's id |
| A reconcile stops before writing a status (Kubernetes API call, finalizer…) | Warning | KubernetesApiError, AuthentikApiError, SecretStoreError | Reconcile | the error |
| A finalizer cleanup fails | Warning | the failure's code | Cleanup | the error |
| The finalizer finishes its cleanup | Normal | Released | Cleanup | cleanup finished, finalizer released |
The CR is force-orphaned (authentik.weebo.io/force-orphan: "true") | Normal | Released | Cleanup | force-orphaned (authentik.weebo.io/force-orphan): released without cleanup |
Repeats
A CR that keeps failing is retried about every 30 s, and warns each time. Identical Events (same reason, note and action) are folded into one series whose count goes up, so a stuck CR shows one line, not hundreds, and the apiserver isn't flooded. A note is cut at 1000 characters.
Publishing an Event never fails a reconcile: when the apiserver refuses one, the operator logs it and carries on.
Reading them
kubectl describe <kind> <name> -n <namespace> # Events at the bottom
kubectl events -n <namespace> --for <kind>/<name>
kubectl get events -A --field-selector type=WarningThe apiserver keeps Events for an hour by default (--event-ttl): for a
longer history, ship them with an event exporter, or alert on the
reconcile metrics, which carry the same codes.