Kubernetes exporter

Watches Deployment rollouts (and optionally ConfigMap / Secret changes) and pushes Evidence Events to ingest. It runs in your cluster with read-only RBAC. No application code changes.

Code: Evitrus/exporter → k8s/.

Requirements

• A tenant API key with the ingest scope (evt_live_…)
• Helm 3
• Permission to install into a namespace you control

Install guide

git clone --depth 1 https://github.com/Evitrus/exporter.git
helm install evitrus-k8s-exporter ./exporter/k8s/chart \
  --namespace evitrus --create-namespace \
  --set ingest.url=https://api.evitrus.io/ingest \
  --set ingest.apiKey=$EVITRUS_KEY

Prefer a Kubernetes Secret over --set ingest.apiKey. Set ingest.existingSecret to a Secret that contains the key api-key.

Value	Default	Purpose
ingest.url	—	https://api.evitrus.io/ingest
ingest.apiKey	—	Tenant key. Prefer ingest.existingSecret
watchConfigMaps	true	Emit config changes
watchSecrets	false	Enable only if you need Secret change evidence
watchNamespace	all	Limit the watch to one namespace
environmentMap	—	namespace: env aliases when a workload has no environment annotation
emitInitial	false	Emit for resources already present at startup

Secret values are never emitted. Only key names and hashes are recorded. Enabling watchSecrets grants the exporter read access to Secrets.

To turn Secret watching on after install:

helm upgrade evitrus-k8s-exporter ./exporter/k8s/chart \
  --reuse-values --set watchSecrets=true

Annotate workloads so the service, environment, and commit match your other exporters:

metadata:
  annotations:
    evitrus.io/service: payments-api
    evitrus.io/environment: prod
    evitrus.io/commit: a1b2c3d4e5f6
    # Skip this resource entirely:
    # evitrus.io/ignore: "true"

Resolution order when an annotation is absent:

• service — app.kubernetes.io/name, then the Deployment name
• environment — environment or env label, then environmentMap, then the namespace
• commitSha — app.kubernetes.io/version, then a hex image tag

Confirm the controller is shipping events:

kubectl -n evitrus logs deploy/evitrus-k8s-exporter -f

Roll a Deployment and look for deploy.succeeded on that service under Changes.

Ignore rules in the product (Integrations) skip an event type, with optional tags, before POST. evitrus.io/ignore: "true" skips a single resource locally.

To gate annotated workloads, install the Kubernetes evaluator as a separate Deployment.

What it emits

Event types are platform-agnostic (deploy.* / operate.config.*). Kubernetes is source: kubernetes plus metadata (kind, namespace, revision).

Observed signal	Event type
Completed Deployment rollout	deploy.succeeded
ConfigMap data change	operate.config.changed
Secret data change (if enabled)	operate.config.changed

The deploy vocabulary shared with ECS and other runtimes is deploy.started, deploy.progressed, deploy.succeeded, deploy.failed, deploy.rolled_back, and deploy.blocked. This exporter emits deploy.succeeded when a rollout finishes (observedGeneration caught up, replicas updated and available).

The primary container image and its digest are attached to the event. That digest is what ties a CI build to the running Deployment.