Kubernetes exporter

Watches Deployment rollouts (and optionally ConfigMap / Secret changes) and pushes Evidence Events to the Evitrus ingest API. Runs in your cluster with read-only RBAC — no application code changes.

Prerequisites

• A tenant ingest API key (evt_live_…)
• Helm 3
• Cluster access to install into a namespace you control

Install with Helm

From the exporter repository k8s/chart (path may vary by release — use the chart shipped with the exporter):

helm install evitrus-k8s-exporter ./chart \
  --namespace evitrus --create-namespace \
  --set ingest.url=https://api.evitrus.dev/ingest \
  --set ingest.apiKey=<your-tenant-key>

Recommended values

Value	Purpose
ingest.url	https://api.evitrus.dev/ingest (dev)
ingest.apiKey	Tenant key (prefer a Kubernetes Secret ref)
watch.configMaps	true by default
watch.secrets	false by default — enable only if needed

Secret values are never emitted. Only key names and hashes are recorded.

What it emits

Types are platform-agnostic (deploy.* / operate.config.*). Kubernetes is recorded only as source: kubernetes plus metadata (kind, namespace, revision) — never as k8s.* event types.

Observed signal	Event type
Completed Deployment rollout	deploy.succeeded
ConfigMap data change	operate.config.changed (action in metadata)
Secret data change (if enabled)	operate.config.changed (action in metadata)

Canonical deploy vocabulary (same types for ECS, Lambda, ACA, bare metal, …): deploy.started, deploy.progressed, deploy.succeeded, deploy.failed, deploy.rolled_back, deploy.blocked. This exporter currently emits deploy.succeeded on completed rollouts.

Correlation fields:

• service ← evitrus.dev/service annotation → app.kubernetes.io/name → Deployment name
• environment ← evitrus.dev/environment → env label → --environment-map namespace alias → namespace
• commitSha ← evitrus.dev/commit → version label → hex image tag
• Image digest on the primary container artifact (load-bearing for Change identity)

Annotations

metadata:
  annotations:
    evitrus.dev/service: payments-api
    evitrus.dev/environment: prod
    evitrus.dev/commit: a1b2c3d4e5f6
    # Skip this resource entirely:
    # evitrus.dev/ignore: "true"

Silence noisy resources

In the product UI under Integrations, add tenant ignore rules (event type plus optional tags, same matcher as controls: exact or deploy.*). Every customer-hosted exporter polls GET /ingest/config and skips matching events before POST; ingest still refuses them with 422 {ignored:true}. Keep evitrus.dev/ignore: "true" as a local skip for a single Kubernetes resource.

Verify

kubectl -n evitrus logs deploy/evitrus-k8s-exporter -f

Roll a Deployment and confirm a deploy.succeeded event for that service in Changelog. To gate annotated workloads, install the Kubernetes evaluator as a separate Deployment.