Persistent Kubernetes Investigation History
- Capture new issue observations, confirmed recovery, deletion and recurrence,
alongside Timeline changes and crashes—even with no browser open or alerts enabled. - Keep captured evidence across restarts and resource deletion with persistent
storage. Historical observations remain separate from current active-issue counts. - Investigate 7 days, 30 days, 90 days or all retained evidence through the existing
time selector, with resource filters and pagination. No new history screen is required. - Report incomplete and missed coverage explicitly instead of presenting missing
evidence as proof that nothing happened.
Reliable Long-Running Synchronization
- Recover background collection after supported credential renewal, temporary
upstream/provider failures and worker interruption without depending on a page visit. - Refresh renewable AWS role credentials and EKS bearer tokens at their respective
expiry boundaries, with coordinated refreshes and bounded retries. - Keep the last authorized committed snapshot visible during ordinary refresh
failures. Prevent warming responses from replacing useful data with false zeros. - Keep Preparing limited to first publication. Later routine refreshes use the
existing top-bar indicator, and snapshot ages reflect observation—not query—time. - Clear protected views when access is revoked and restore them automatically after
reauthorization. Authorized partial data stays usable with truthful Degraded warnings. - Reject malformed collection responses rather than treating them as complete empty
inventory or evidence of successful recovery.
Storage Policies
- PostgreSQL: no automatic application-imposed age, record-count or total-byte
retention limit for Kubernetes history. Database capacity and intentional
deletion/lifecycle policies remain operator-managed. - File storage: explicit 24-hour, 5,000-record and 4-MiB aggregate history budgets.
Active issue state is protected; capacity pressure reports capture failure rather
than silently discarding active evidence. - Memory storage: ephemeral; restart durability is not provided.
- Historical paging limits bound each request, not the total history retained by
PostgreSQL. Existing raw container-log limits remain separate. - History applies to new captures. Older evidence is not imported or backfilled.
Enterprise
- Preserve organization, allowed-cluster and namespace boundaries throughout
capture, restart, renewal and historical queries. - Require current authority and matching physical-cluster identity for protected
stored evidence; an older snapshot is not a workaround for revoked permissions. - Keep durable history and synchronization improvements available as shared OSS
capabilities, with Enterprise storage integration respecting existing access controls.
Operational Notes
- Temporary AWS sessions pasted into static configuration and directly supplied
bearer tokens cannot renew themselves. Use a supported renewable provider or
replace those credentials externally. - Recovery time depends on cluster size, permitted scope, collection and upstream
conditions. No fixed recovery-time or production EKS diagnosis is promised. - Gaps from missed collection or file pruning cannot be reconstructed automatically.
- Existing alert delivery is at-least-once: if a channel accepts a notification but
the sender crashes before recording the acknowledgement, a retry can deliver it
again. Durable history does not add receiver-side exactly-once delivery. - The matching OSS and Enterprise changes must ship together. Enterprise's build
tag currently names v1.4.32 and must be aligned before a paired v1.4.33 release.
What's Changed
- feat(kubernetes): retain investigation history and recover long-running sync by @hoalongnatsu in #394
- sec: fix CodeQL scan by @hoalongnatsu in #395
Full Changelog: v1.4.32...v1.4.33