Back to Details

huawei-cloud-cce-kubernetes-event-analyzer

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Huawei Cloud CCE Kubernetes Event Analyzer

华为云CCE Kubernetes事件分析器

Overview

概述

Query and analyze Kubernetes Events in Huawei Cloud CCE clusters to identify warnings, repeated failure patterns, affected resources, and useful diagnosis handoffs. The skill supports a current Event view through 
kubectl
and a historical Event view through LTS.
Architecture: 
python3 scripts/huawei-cloud.py
dispatcher -> 
kubectl
through external kubeconfig or 
kubectl cce
for current Events / 
kubectl cce
LogConfig discovery plus 
hcloud LTS ListLogs
for historical Events -> filtering and grouping -> diagnosis handoff.
Execution Method: Invoke only the bundled dispatcher. Do not query Kubernetes Events with raw Python Kubernetes SDK calls, direct Kubernetes API calls, or ad hoc cloud commands. The 
huawei_get_cce_events
implementation invokes 
kubectl
internally: external kubeconfig access first, then the 
kubectl cce
plugin fallback.
Related Skills:
  • huawei-cloud-kubectl-cce-installer
    - Install 
    kubectl
    and the 
    kubectl-cce
    plugin required for cluster access
  • huawei-cloud-cce-metric-analyzer
    - CCE and cloud-resource metrics
Capabilities:
  • Query current Kubernetes Events across a cluster or in a namespace
  • Read Events through external 
    kubectl
    kubeconfig access or 
    kubectl cce
  • Query historical Event records from LTS within an explicit time window
  • Filter and group Events by type, reason, namespace, resource, and timestamps
  • Check the current status of supported resources referenced by Events
  • Analyze a supplied current or historical Event result locally without another cloud request
  • Identify repeated warning patterns and hand off evidence to diagnosis skills
Typical Use Cases:
  • "List Warning events for this CCE cluster"
  • "Find repeated FailedScheduling events in namespace default"
  • "Query historical ImagePullBackOff events from LTS"
  • "Analyze the top Kubernetes event reasons during an incident"
用于查询和分析华为云CCE集群中的Kubernetes Events，以识别警告、重复故障模式、受影响资源以及有用的诊断交接信息。本技能支持通过
kubectl
查看当前Events，以及通过LTS查看历史Events。
架构：
python3 scripts/huawei-cloud.py
调度器 -> 通过外部kubeconfig调用
kubectl
或使用
kubectl cce
查询当前Events / 通过
kubectl cce
发现LogConfig并配合
hcloud LTS ListLogs
查询历史Events -> 过滤与分组 -> 诊断交接。
执行方式：仅调用随附的调度器。禁止使用原生Python Kubernetes SDK调用、直接Kubernetes API调用或临时云命令查询Kubernetes Events。
huawei_get_cce_events
的实现内部会调用
kubectl
：优先使用外部kubeconfig访问，兜底使用
kubectl cce
插件。
相关技能:
  • huawei-cloud-kubectl-cce-installer
    - 安装集群访问所需的
    kubectl
    和
    kubectl-cce
    插件
  • huawei-cloud-cce-metric-analyzer
    - CCE及云资源指标分析
功能:
  • 查询整个集群或单个命名空间内的当前Kubernetes Events
  • 通过外部
    kubectl
    kubeconfig访问或
    kubectl cce
    读取Events
  • 在指定时间窗口内从LTS查询历史Event记录
  • 按类型、原因、命名空间、资源和时间戳对Events进行过滤和分组
  • 检查Events引用的受支持资源的当前状态
  • 无需额外云请求，本地分析提供的当前或历史Event结果
  • 识别重复警告模式并将证据移交给诊断技能
典型使用场景:
  • "列出该CCE集群的Warning事件"
  • "查找default命名空间中重复的FailedScheduling事件"
  • "从LTS查询历史ImagePullBackOff事件"
  • "分析故障期间排名靠前的Kubernetes事件原因"

Prerequisites

前提条件

1. Runtime Dependencies

1. 运行时依赖

  • Python 3.8+ for the dispatcher and result processing
  • hcloud
    (KooCLI) for cluster lookup and temporary external kubeconfig generation
  • kubectl
    for current Event reads
  • kubectl-cce
    when the cluster has no usable external endpoint; see kubectl-cce.md
  • hcloud
    LTS command support and the Cloud Native Log Collection add-on (
    log-agent
    ) with a 
    default-event
    Event-to-LTS 
    LogConfig
    . 
    huawei_query_k8s_events_from_lts
    reads 
    logconfigs.logging.openvessel.io
    through 
    kubectl cce
    , then invokes 
    hcloud LTS ListLogs
    using the configured LTS IDs.
  • 调度器与结果处理需要Python 3.8+
  • 用于集群查询和临时外部kubeconfig生成的
    hcloud
    (KooCLI)
  • 用于当前Event读取的
    kubectl
  • 当集群没有可用外部端点时需要
    kubectl-cce
    ；参见kubectl-cce.md
  • 需要
    hcloud
    LTS命令支持，以及云原生日志采集插件（
    log-agent
    ）并配置了
    default-event
    类型的Event-to-LTS 
    LogConfig
    。
    huawei_query_k8s_events_from_lts
    会通过
    kubectl cce
    读取
    logconfigs.logging.openvessel.io
    ，然后使用配置的LTS ID调用
    hcloud LTS ListLogs
    。

2. Credential Configuration

2. 凭证配置

  • External kubeconfig access uses hcloud credential priority: explicit tool parameters > local hcloud profile > environment variables.
  • The 
    kubectl cce
    fallback requires AK/SK and the target cluster's 
    project_id
    from explicit tool parameters or environment variables; encrypted hcloud profile credentials cannot be reused by the plugin. When 
    project_id
    is available, the implementation passes it explicitly as 
    kubectl cce --project-id <project-id>
    .
  • LTS queries require valid Huawei Cloud credentials and an authorized project.
Security Rules:
  • Never print, persist, or hardcode AK/SK, security tokens, kubeconfig content, or temporary client credentials.
  • Never use 
    echo $HUAWEI_AK
    or 
    echo $HUAWEI_SK
    to inspect credentials.
  • Prefer a local hcloud profile for external kubeconfig access.
  • Use least-privilege IAM identities and read-only Kubernetes RBAC permissions.
Optional Environment Fallback:
bash
export HUAWEI_AK=<your-ak>
export HUAWEI_SK=<your-sk>
export HUAWEI_REGION=cn-north-4
export HUAWEI_PROJECT_ID=<project-id>
export HUAWEI_SECURITY_TOKEN=<security-token>
  • 外部kubeconfig访问遵循hcloud凭证优先级：显式工具参数 > 本地hcloud配置文件 > 环境变量。
  • kubectl cce
    兜底方式需要AK/SK以及目标集群的
    project_id
    ，这些信息来自显式工具参数或环境变量；加密的hcloud配置文件凭证无法被插件复用。当
    project_id
    可用时，实现会显式通过
    kubectl cce --project-id <project-id>
    传递。
  • LTS查询需要有效的华为云凭证和已授权的项目。
安全规则:
  • 严禁打印、持久化或硬编码AK/SK、安全令牌、kubeconfig内容或临时客户端凭证。
  • 严禁使用
    echo $HUAWEI_AK
    或
    echo $HUAWEI_SK
    查看凭证。
  • 优先使用本地hcloud配置文件进行外部kubeconfig访问。
  • 使用最小权限IAM身份和只读Kubernetes RBAC权限。
可选环境变量兜底方案:
bash
export HUAWEI_AK=<your-ak>
export HUAWEI_SK=<your-sk>
export HUAWEI_REGION=cn-north-4
export HUAWEI_PROJECT_ID=<project-id>
export HUAWEI_SECURITY_TOKEN=<security-token>

3. IAM Permission Requirements

3. IAM权限要求

PermissionPurpose
cce:cluster:get
Inspect cluster external endpoint availability
cce:cluster:createCert
Generate temporary kubeconfig for external 
kubectl
access
lts:logs:search
Query historical Event records in LTS
The effective Kubernetes identity also needs read-only 
get
and 
list
permission for Events in the target namespace or cluster.
Permission Failure Handling:
  1. Report the failed operation and required permission.
  2. Ask the user to grant the missing IAM or Kubernetes RBAC permission.
  3. Do not retry until the user confirms the permission is ready.
权限用途
cce:cluster:get
检查集群外部端点可用性
cce:cluster:createCert
生成用于外部
kubectl
访问的临时kubeconfig
lts:logs:search
查询LTS中的历史Event记录
生效的Kubernetes身份还需要对目标命名空间或集群的Events拥有只读
get
和
list
权限。
权限失败处理:
  1. 报告失败的操作和所需权限。
  2. 请用户授予缺失的IAM或Kubernetes RBAC权限。
  3. 在用户确认权限已配置前不要重试。

Core Commands

核心命令

All commands use the bundled dispatcher:
bash
python3 scripts/huawei-cloud.py <tool-name> key=value key=value
所有命令均使用随附的调度器：
bash
python3 scripts/huawei-cloud.py <tool-name> key=value key=value

KooCLI Command Format Standard

KooCLI命令格式规范

Users invoke the dispatcher rather than raw 
hcloud
commands. For current Event queries, the dispatcher internally uses hcloud only to inspect the CCE cluster and generate a temporary external kubeconfig when appropriate.
bash
python3 scripts/huawei-cloud.py huawei_get_cce_events \
  region=cn-north-4 cluster_id=<cluster-id>
Follow these rules:
  • Use 
    key=value
    parameters and quote values containing spaces or special shell characters.
  • Do not print or persist credentials, security tokens, or temporary kubeconfig files.
  • Use exact 
    cluster_id
    values for cluster-scoped queries.
  • Keep LTS queries time-bounded with both 
    start_time
    and 
    end_time
    .
用户调用调度器而非直接使用原生
hcloud
命令。对于当前事件查询，调度器内部仅在需要时使用hcloud检查CCE集群并生成临时外部kubeconfig。
bash
python3 scripts/huawei-cloud.py huawei_get_cce_events \
  region=cn-north-4 cluster_id=<cluster-id>
遵循以下规则：
  • 使用
    key=value
    格式的参数，包含空格或特殊Shell字符的参数值需加引号。
  • 不要打印或持久化凭证、安全令牌或临时kubeconfig文件。
  • 集群范围的查询使用精确的
    cluster_id
    值。
  • LTS查询需同时指定
    start_time
    和
    end_time
    以限定时间范围。

1. Current Kubernetes Events

1. 当前Kubernetes Events

bash
undefined
bash
undefined

Query Warning Events (default)

查询Warning Events（默认）

python3 scripts/huawei-cloud.py huawei_get_cce_events
region=cn-north-4 cluster_id=<cluster-id>
python3 scripts/huawei-cloud.py huawei_get_cce_events
region=cn-north-4 cluster_id=<cluster-id>

Query Events in a namespace

查询指定命名空间内的Events

python3 scripts/huawei-cloud.py huawei_get_cce_events
region=cn-north-4 cluster_id=<cluster-id> namespace=default
python3 scripts/huawei-cloud.py huawei_get_cce_events
region=cn-north-4 cluster_id=<cluster-id> namespace=default

Limit returned Event records

限制返回的Event记录数

python3 scripts/huawei-cloud.py huawei_get_cce_events
region=cn-north-4 cluster_id=<cluster-id> limit=100
python3 scripts/huawei-cloud.py huawei_get_cce_events
region=cn-north-4 cluster_id=<cluster-id> limit=100

Query all Event types only when explicitly needed

仅在明确需要时查询所有Event类型

python3 scripts/huawei-cloud.py huawei_get_cce_events
region=cn-north-4 cluster_id=<cluster-id> event_type=all limit=100

The tool returns only Warning Events by default, using the Kubernetes API server-side field selector. It first uses the external endpoint with a temporary kubeconfig; it then falls back to `kubectl cce`. For large clusters, full Event history can be substantial; query all types only after the user explicitly requests it with `event_type=all`.
python3 scripts/huawei-cloud.py huawei_get_cce_events
region=cn-north-4 cluster_id=<cluster-id> event_type=all limit=100

该工具默认仅返回Warning Events，使用Kubernetes API服务端字段选择器实现。它优先通过临时kubeconfig使用外部端点访问，失败则兜底使用`kubectl cce`。对于大型集群，完整事件历史数据量可能很大；仅在用户通过`event_type=all`显式请求时才查询所有类型。

2. Historical Events From LTS

2. 来自LTS的历史事件

bash
undefined
bash
undefined

Query an explicit historical window

查询指定历史时间窗口

python3 scripts/huawei-cloud.py huawei_query_k8s_events_from_lts
region=cn-north-4 cluster_id=<cluster-id>
start_time="2026-05-30 06:00:00"
end_time="2026-05-30 08:00:00"
python3 scripts/huawei-cloud.py huawei_query_k8s_events_from_lts
region=cn-north-4 cluster_id=<cluster-id>
start_time="2026-05-30 06:00:00"
end_time="2026-05-30 08:00:00"

Query with an LTS keyword filter

带LTS关键字过滤的查询

python3 scripts/huawei-cloud.py huawei_query_k8s_events_from_lts
region=cn-north-4 cluster_id=<cluster-id>
start_time="2026-05-30 00:00:00"
end_time="2026-05-30 23:59:59"
keywords=FailedScheduling

LTS time format is UTC `YYYY-MM-DD HH:MM:SS`; the tool always interprets input values as UTC, not the local time zone of the host. The cluster must have the Cloud Native Log Collection add-on (`log-agent`) installed and healthy with the `default-event` Event-to-LTS `LogConfig`. The tool uses `kubectl cce --cluster-id <cluster-id> --region <region> get logconfigs.logging.openvessel.io -A -o json`, selects `default-event`, and reads `outputDetail.LTS.ltsGroupID` and `ltsStreamID`. LTS queries default to `event_type=Warning`, using `Warning` as a server-side keyword filter. For large clusters, request full Event history only after user confirmation with `event_type=all`; this removes the type keyword filter. LTS filtering is keyword matching, not a structured-field selector.
python3 scripts/huawei-cloud.py huawei_query_k8s_events_from_lts
region=cn-north-4 cluster_id=<cluster-id>
start_time="2026-05-30 00:00:00"
end_time="2026-05-30 23:59:59"
keywords=FailedScheduling

LTS时间格式为UTC时区的`YYYY-MM-DD HH:MM:SS`；工具始终将输入值视为UTC时间，而非主机的本地时区。集群必须安装云原生日志采集插件（`log-agent`）且运行正常，并配置了`default-event`类型的Event-to-LTS `LogConfig`。工具会使用`kubectl cce --cluster-id <cluster-id> --region <region> get logconfigs.logging.openvessel.io -A -o json`，选择`default-event`配置，并读取`outputDetail.LTS.ltsGroupID`和`ltsStreamID`。LTS查询默认为`event_type=Warning`，使用`Warning`作为服务端关键字过滤器。对于大型集群，仅在用户通过`event_type=all`确认后才请求完整事件历史；这会移除类型关键字过滤。LTS过滤是关键字匹配，而非结构化字段选择器。

3. Query and Analyze Event Results

3. 查询并分析事件结果

Without 
events
, the tool queries and analyzes current cluster Events by default. For historical requests spanning more than one hour, use LTS with a bounded time window. Providing 
start_time
or 
end_time
automatically selects LTS; 
event_source=lts
may also be set explicitly. Passing an 
events
array (or a complete response object containing it) retains offline analysis behavior.
bash
undefined
未提供
events
参数时，工具默认查询并分析当前集群Events。对于超过一小时的历史查询请求，请使用带时间窗口限制的LTS。提供
start_time
或
end_time
会自动选择LTS；也可以显式设置
event_source=lts
。传入
events
数组（或包含该数组的完整响应对象）将启用离线分析模式。
bash
undefined

Query and analyze current Events

查询并分析当前Events

python3 scripts/huawei-cloud.py huawei_analyze_cce_events
region=cn-north-4 cluster_id=<cluster-id>
python3 scripts/huawei-cloud.py huawei_analyze_cce_events
region=cn-north-4 cluster_id=<cluster-id>

Query and analyze historical LTS Events

查询并分析LTS历史Events

python3 scripts/huawei-cloud.py huawei_analyze_cce_events
region=cn-north-4 cluster_id=<cluster-id> event_source=lts
start_time="2026-05-30 06:00:00" end_time="2026-05-30 08:00:00"
python3 scripts/huawei-cloud.py huawei_analyze_cce_events
region=cn-north-4 cluster_id=<cluster-id> event_source=lts
start_time="2026-05-30 06:00:00" end_time="2026-05-30 08:00:00"

Analyze supplied Events without a cloud query

无需云查询，分析提供的Events

python3 scripts/huawei-cloud.py huawei_analyze_cce_events
events='[{"type":"Warning","reason":"FailedScheduling","namespace":"default","count":3}]'
max_groups=10
undefined
python3 scripts/huawei-cloud.py huawei_analyze_cce_events
events='[{"type":"Warning","reason":"FailedScheduling","namespace":"default","count":3}]'
max_groups=10
undefined

Risk Levels

风险等级

This skill is read-only. It never changes cloud resources, Kubernetes resources, LTS configuration, or local cluster access configuration.
LevelMeaningExecution Guidance
R3Read-only Event query or local Event analysisMay run automatically
ToolOperation TypeRisk LevelDescription
huawei_get_cce_events
QueryR3Query current cluster or namespace Events through 
kubectl
huawei_query_k8s_events_from_lts
QueryR3Query historical Event records from configured LTS collection
huawei_analyze_cce_events
Query and analyzeR3Query current or LTS Events when needed, then aggregate by type, reason, namespace, and resource
本技能为只读模式。它永远不会修改云资源、Kubernetes资源、LTS配置或本地集群访问配置。
等级含义执行指引
R3只读Event查询或本地Event分析可自动运行
工具操作类型风险等级描述
huawei_get_cce_events
查询R3通过
kubectl
查询当前集群或命名空间Events
huawei_query_k8s_events_from_lts
查询R3从配置的LTS采集项中查询历史Event记录
huawei_analyze_cce_events
查询与分析R3必要时查询当前或LTS Events，然后按类型、原因、命名空间和资源聚合

Parameter Reference

参数参考

Common Parameters

通用参数

ParameterRequired/OptionalDescriptionDefault
region
RequiredHuawei Cloud region
HUAWEI_REGION
cluster_id
RequiredExact CCE cluster IDN/A
ak
OptionalExplicit AK for access paths that support itprofile/environment fallback
sk
OptionalExplicit SK for access paths that support itprofile/environment fallback
project_id
Required for 
kubectl cce
; optional otherwise		Target cluster's Huawei Cloud project IDhcloud profile/IAM/environment fallback for external kubeconfig access
参数必填/可选描述默认值
region
必填华为云区域
HUAWEI_REGION
cluster_id
必填精确的CCE集群ID无
ak
可选用于支持显式凭证的访问路径的AK配置文件/环境变量兜底
sk
可选用于支持显式凭证的访问路径的SK配置文件/环境变量兜底
project_id
kubectl cce
方式必填；其他方式可选		目标集群的华为云项目ID外部kubeconfig访问使用hcloud配置文件/IAM/环境变量兜底

Current Event Query Parameters

当前事件查询参数

ToolRequiredOptional
huawei_get_cce_events
region
, 
cluster_id
namespace
, 
event_type
(
Warning
default, 
Normal
, or 
all
), 
limit
, 
ak
, 
sk
, 
project_id
(required for 
kubectl cce
), 
security_token
工具必填参数可选参数
huawei_get_cce_events
region
, 
cluster_id
namespace
, 
event_type
（默认
Warning
，可选
Normal
或
all
）, 
limit
, 
ak
, 
sk
, 
project_id
（
kubectl cce
方式必填）, 
security_token

Historical Event Query Parameters

历史事件查询参数

ToolRequiredOptional
huawei_query_k8s_events_from_lts
region
, 
cluster_id
, 
start_time
, 
end_time
, 
project_id
event_type
(
Warning
default, 
Normal
, or 
all
), 
keywords
(requires 
event_type=all
), 
ak
, 
sk
工具必填参数可选参数
huawei_query_k8s_events_from_lts
region
, 
cluster_id
, 
start_time
, 
end_time
, 
project_id
event_type
（默认
Warning
，可选
Normal
或
all
）, 
keywords
（需要
event_type=all
）, 
ak
, 
sk

Event Analysis Parameters

事件分析参数

ToolRequiredOptional
huawei_analyze_cce_events
Either 
events
, or 
region
+ 
cluster_id
event_source
(
current
default or 
lts
), 
start_time
/
end_time
(required for 
lts
), 
namespace
, 
event_type
, 
keywords
, 
limit
, 
max_groups
(1-100, default 10), 
check_resource_status
(default true when 
region
and 
cluster_id
are present), 
ak
, 
sk
, 
project_id
, 
security_token
工具必填参数可选参数
huawei_analyze_cce_events
events
，或
region
+ 
cluster_id
event_source
（默认
current
或
lts
）, 
start_time
/
end_time
（
lts
方式必填）, 
namespace
, 
event_type
, 
keywords
, 
limit
, 
max_groups
（1-100，默认10）, 
check_resource_status
（当存在
region
和
cluster_id
时默认为true）, 
ak
, 
sk
, 
project_id
, 
security_token

Output Format

输出格式

All public response fields, Event record fields, and resource-status states are defined in output-schema.md. That reference is the single source of truth for output contracts.
所有公共响应字段、Event记录字段和资源状态均在output-schema.md中定义。该参考文档是输出契约的唯一可信来源。

Workflow

工作流程

  1. Identify 
    region
    , exact 
    cluster_id
    , optional namespace, and incident time window.
  2. Use 
    huawei_get_cce_events
    for current Event inspection.
  3. Use 
    huawei_query_k8s_events_from_lts
    for historical Event windows longer than one hour, or when a precise LTS time range or keyword filtering is required.
  4. Pass the returned 
    events
    to 
    huawei_analyze_cce_events
    to aggregate reasons, namespaces, resources, and repeated patterns.
  5. Hand off evidence to the relevant Pod, Workload, Node, Storage, or Network diagnosis skill.
See workflow.md for pattern recognition and time-window analysis guidance.
  1. 确定
    region
    、精确的
    cluster_id
    、可选的命名空间和故障时间窗口。
  2. 使用
    huawei_get_cce_events
    进行当前Event检查。
  3. 对于超过一小时的历史事件窗口，或需要精确LTS时间范围或关键字过滤时，使用
    huawei_query_k8s_events_from_lts
    。
  4. 将返回的
    events
    传递给
    huawei_analyze_cce_events
    ，以聚合原因、命名空间、资源和重复模式。
  5. 将证据移交给相关的Pod、工作负载、节点、存储或网络诊断技能。
有关模式识别和时间窗口分析的指导，请参见workflow.md。

Verification

验证方式

Run a current Event query first:
bash
python3 scripts/huawei-cloud.py huawei_get_cce_events \
  region=cn-north-4 cluster_id=<cluster-id> limit=10
When default Event-to-LTS collection is enabled, verify a bounded historical query:
bash
python3 scripts/huawei-cloud.py huawei_query_k8s_events_from_lts \
  region=cn-north-4 cluster_id=<cluster-id> \
  start_time="2026-05-30 06:00:00" \
  end_time="2026-05-30 07:00:00"
Verify that the current Event response includes 
access_method
, and that the LTS response identifies the default LTS group and stream. Do not create or change logging configuration as part of verification.
首先运行当前Event查询：
bash
python3 scripts/huawei-cloud.py huawei_get_cce_events \
  region=cn-north-4 cluster_id=<cluster-id> limit=10
当启用了默认Event-to-LTS采集时，验证带限制的历史查询：
bash
python3 scripts/huawei-cloud.py huawei_query_k8s_events_from_lts \
  region=cn-north-4 cluster_id=<cluster-id> \
  start_time="2026-05-30 06:00:00" \
  end_time="2026-05-30 07:00:00"
验证当前Event响应包含
access_method
，且LTS响应标识出默认LTS日志组和日志流。验证过程中不要创建或修改日志配置。

Best Practices

最佳实践

  1. Start with warnings - filter 
    type == "Warning"
    before detailed inspection.
  2. Group by reason - repeated reasons reveal systemic issues faster than individual records.
  3. Use exact cluster IDs - do not infer a cluster from its name.
  4. Keep LTS windows bounded - use the smallest incident window that answers the question.
  5. Use LTS for history - current Kubernetes Events have limited retention.
  6. Hand off rather than remediate - this skill provides evidence only.
  1. 从警告开始排查 - 在详细检查前先过滤
    type == "Warning"
    的事件。
  2. 按原因分组 - 重复出现的原因比单个记录能更快揭示系统性问题。
  3. 使用精确的集群ID - 不要从集群名称推断集群。
  4. 限定LTS时间窗口 - 使用能满足查询需求的最小故障时间窗口。
  5. 历史查询用LTS - 当前Kubernetes Events的保留期有限。
  6. 仅交接不修复 - 本技能仅提供证据。

Notes

注意事项

  • No active warning does not prove a cluster is healthy; inspect historical LTS Events for recent or recovered incidents when available.
  • The Event-to-LTS path depends on a healthy log-agent add-on with default Event collection enabled.
  • Event summaries should redact sensitive production workload, Pod, and node identifiers where the audience does not need them.
  • Do not modify Kubernetes, CCE logging, LTS, or cloud resources through this skill.
  • 没有活动警告并不代表集群健康；如有可能，请检查历史LTS Events以了解近期或已恢复的故障。
  • Event-to-LTS链路依赖于健康的log-agent插件，且已启用默认Event采集。
  • 当受众不需要时，事件摘要应对敏感的生产工作负载、Pod和节点标识符进行脱敏。
  • 禁止通过本技能修改Kubernetes、CCE日志、LTS或云资源。

Troubleshooting

故障排查

SymptomLikely CauseAction
External kubeconfig access failsNo external endpoint, invalid profile, or missing CCE permissionVerify 
cce:cluster:get
and 
cce:cluster:createCert
; the tool then tries 
kubectl cce
kubectl cce
fallback fails		Plugin missing or plugin credentials unavailableInstall/configure the plugin using kubectl-cce.md
LTS query finds no default Event streamDefault Event collection is not enabled or has not finished provisioningEnable default Event collection through the log-agent add-on, then retry
LTS query returns no recordsTime window, keywords, retention, or event collection does not matchNarrow or correct the window and verify the default LTS group and stream
Too many current EventsBroad cluster queryWarning is the default; provide 
namespace
and a lower 
limit
to further reduce data at the source
Permission deniedMissing IAM or Kubernetes RBAC permissionGrant the reported least-privilege permission, then retry
症状可能原因解决方案
外部kubeconfig访问失败无外部端点、配置文件无效或缺少CCE权限验证
cce:cluster:get
和
cce:cluster:createCert
权限；工具随后会尝试
kubectl cce
kubectl cce
兜底失败		插件缺失或插件凭证不可用使用kubectl-cce.md安装/配置插件
LTS查询未找到默认Event流未启用默认Event采集或尚未完成配置通过log-agent插件启用默认Event采集，然后重试
LTS查询无返回记录时间窗口、关键字、保留期或事件采集不匹配缩小或修正时间窗口，验证默认LTS日志组和日志流
当前Events数量过多集群范围查询过宽默认仅返回Warning；提供
namespace
和更小的
limit
以从源头进一步减少数据量
权限被拒绝缺少IAM或Kubernetes RBAC权限授予报告的最小权限，然后重试

Limitations

限制说明

  • The skill provides only the two documented read-only Event tools.
  • Current Event queries support only namespace and Event type (
    Warning
    , 
    Normal
    , or 
    all
    ) server-side selection.
  • Historical queries require default Event-to-LTS collection enabled before the incident; the skill cannot recover uncollected history.
  • The skill cannot create, modify, or delete LTS streams, Kubernetes resources, or CCE resources.
  • The skill does not automatically select a cluster, namespace, event filter, or diagnosis/remediation action for the user.
  • 本技能仅提供两个已文档化的只读Event工具。
  • 当前Event查询仅支持命名空间和Event类型（
    Warning
    、
    Normal
    或
    all
    ）的服务端筛选。
  • 历史查询要求故障发生前已启用默认Event-to-LTS采集；本技能无法恢复未采集的历史数据。
  • 本技能不能创建、修改或删除LTS日志流、Kubernetes资源或CCE资源。
  • 本技能不会自动为用户选择集群、命名空间、事件过滤器或诊断/修复操作。

References

参考文档

DocumentUse
WorkflowEvent query sequence, grouping, patterns, and time-window analysis
Risk RulesRead-only boundaries, redaction, and handoff constraints
Output SchemaQuery, analysis, and Event record fields
kubectl-ccekubectl-cce installation, credentials, and access fallback
Acceptance CriteriaExpected outcomes for current, historical, and combined query-and-analysis flows
文档用途
工作流程Event查询顺序、分组、模式和时间窗口分析
风险规则只读边界、脱敏和交接约束
输出 schema查询、分析和Event记录字段
kubectl-ccekubectl-cce安装、凭证和访问兜底
验收标准当前、历史和组合查询分析流程的预期结果