Kubernetes Events source plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

The Kubernetes Events source plugin (name: kubernetes_events) lets you ingest data from Kubernetes into a telemetry pipeline. This is a pull-based source plugin.

Supported telemetry types

The Kubernetes Events source plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the Kubernetes Events source plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

Required

Name	Key	Description	Default
Kubernetes API Server Endpoint	`kube_url`	Required. The API server endpoint that’s accessible to Palo Alto Networks Telemetry Pipeline.	`https://kubernetes.default.svc`

Advanced

Name	Key	Description	Default
Kubernetes TLS CA file	`kube_ca_file`	Your Kubernetes CA certificate file.	none
Kubernetes TLS CA path	`kube_ca_path`	Your Kubernetes CA certificate path.	none
Kubernetes authorization Token File*	`kube_token_file`	Your Kubernetes authorization token file.	none
Kubernetes Token Time To Live (TTL)	`kube_token_ttl`	The amount of time before a token is reread from its file.	`10M`
Kubernetes Request Limit	`kube_request_limit`	The request limit for how many events to collect.	`0`
Kubernetes Event Retention Time	`kube_retention_time`	How long Kubernetes should retain events.	`1h`
Kubernetes Namespace	`kube_namespace`	The Kubernetes namespace to query events from. By default, fetches events from all namespaces.	none
Memory Buffer Limit	`mem_buf_limit`	Sets a limit for how much buffered data the plugin can write to memory, which affects backpressure. This value must follow Fluent Bit’s rules for unit sizes. If unspecified, no limit is enforced. For v2 pipelines, this parameter affects only pipelines with the Deployment or DaemonSet workload type. To learn more, see the v2 backpressure guide. For v3 pipelines, this parameter is independent from the OpenTelemetry `memory_limiter` and `batch` processors.	none