{"id":"8bde6baa-f7ca-4c76-943b-356eae20e04f","shortId":"vUeA6m","kind":"skill","title":"whizard-telemetry-ruler","tagline":"Use when working with WizTelemetry Ruler extension for KubeSphere, including installation, configuration, alerting rules management","description":"# WizTelemetry Ruler\n\n## Overview\n\nWizTelemetry Ruler is an extension component in the KubeSphere Observability Platform that provides event alerting and log alerting capabilities. It can define alerting rules for K8s native events, K8s/KubeSphere auditing events, and K8s logs, evaluate incoming event data and log data, and send alerts to specified receivers such as alertmanager, etc.\n\n## When to Use\n\n- Installing or configuring the WizTelemetry Ruler extension\n- Creating, updating, or deleting alerting rules (RuleGroup/ClusterRuleGroup)\n- Managing alerting configurations\n- Using the ruler API to manage alerting rules\n\n## Components\n\n| Component | Description | Default Enabled |\n|-----------|-------------|-----------------|\n| whizard-telemetry-ruler | Core ruler component for alerting | true |\n\n## Dependencies\n\n- **WizTelemetry Platform Service** (whizard-telemetry): Required\n- **WizTelemetry Events** (whizard-events): Required if event alerting is enabled\n- **WizTelemetry Auditing** (whizard-auditing): Required if auditing alerting is enabled\n- **WizTelemetry Logging** (whizard-logging): Required if logging alerting is enabled\n- **WizTelemetry Notification** (whizard-notification): Optional (for alert notification)\n- **WizTelemetry Data Pipeline** (vector): Required if alerting persistence is enabled\n- **OpenSearch** (opensearch): Required if alerting persistence is enabled\n- \n## Installation\n\n### Prerequisites\n\n**REQUIRED: Complete all steps in order before generating InstallPlan.**\n\n#### Step 1: Get Available Clusters and Confirm Target\n\n**⚠️ CRITICAL: DO NOT proceed until target clusters are determined.**\n\n**Step 1.1: Get available clusters**\n\n```bash\nkubectl get clusters -o jsonpath='{.items[*].metadata.name}'\n```\n\n**Step 1.2: Determine target clusters**\n\n- If user **explicitly specified** target clusters in the request → Use those clusters directly, proceed to Step 2\n- If user **did NOT specify** target clusters → Ask user to confirm which clusters to deploy to, then proceed to Step 2\n\n**Ask user (if not specified):**\n```\nAvailable clusters: host, dev\nWhich clusters do you want to deploy WizTelemetry Ruler to?\n```\n\n#### Step 2: Get Latest Version (if not provided by user)\n\n**MUST do this to get the latest version:**\n\n```bash\nkubectl get extensionversions -n kubesphere-system -l kubesphere.io/extension-ref=whizard-telemetry-ruler -o jsonpath='{range .items[*]}{.spec.version}{\"\\n\"}{end}' | sort -V | tail -1\n```\n\nThis outputs the latest version (e.g., `1.5.0`). Note this down - you'll use it in the InstallPlan.\n\n#### Step 3: Get AlertManager Host (if configuring sink)\n\n**Only perform this step if you need to configure sink for alert notifications.**\n\nThe AlertManager proxy service (`alertmanager-proxy`) is deployed in the host cluster and exposed via NodePort (default port: 31093).\n\n**Step 3.1: Get a host node IP**\n\n```bash\nkubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type==\"InternalIP\")].address}'\n```\n\n**Step 3.2: Confirm with user**\n\nAsk user to confirm the AlertManager host IP:\n```\nDetected AlertManager host: <NODE_IP>\nDetected AlertManager port: 31093\nAlert URL: http://<NODE_IP>:31093/api/v1/alerts\n\nDo you want to use this URL for alert notifications?\n```\n\n- If user **confirms** → Use `http://<NODE_IP>:31093/api/v1/alerts` as the sink URL\n- If user **provides different URL** → Use the user-specified URL\n\n**Note:** If using WizTelemetry Notification extension, ensure it is installed before installing WizTelemetry Ruler.\n\n### Install WizTelemetry Ruler\n\n**⚠️ IMPORTANT: Complete prerequisite steps BEFORE this step.**\n\nBased on your selections:\n- **Target clusters**: User-confirmed cluster names\n- **AlertManager URL**: From Step 3 (if configuring sink)\n\n**⚠️ CRITICAL: InstallPlan `metadata.name` MUST be `whizard-telemetry-ruler`. DO NOT use any other name.**\n\n**⚠️ CRITICAL: `config` field is YAML format. You MUST:**\n- Use the config structure exactly as shown in the template\n- **DO NOT** add configuration fields that are not shown in the template\n- **DO NOT** modify the structure or hierarchy\n\n**⚠️ CRITICAL: All placeholders MUST be replaced with actual values. DO NOT leave them as placeholders.**\n\n#### Basic Installation Template (with AlertManager)\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: whizard-telemetry-ruler\n  namespace: kubesphere-system\nspec:\n  extension:\n    name: whizard-telemetry-ruler\n    version: <VERSION>  # From Step 2\n  enabled: true\n  upgradeStrategy: Manual\n  config: |\n    whizard-telemetry-ruler:\n      config:\n        sinks:\n          - name: alertmanager\n            type: webhook\n            config:\n              url: http://<ALERT_MANAGER_HOST>:31093/api/v1/alerts  # From Step 3\n  clusterScheduling:\n    placement:\n      clusters:\n        - <TARGET_CLUSTERS>\n```\n\n#### Installation with Custom Configuration Template (with all alerting types)\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: whizard-telemetry-ruler\n  namespace: kubesphere-system\nspec:\n  extension:\n    name: whizard-telemetry-ruler\n    version: <VERSION>  # From Step 2\n  enabled: true\n  upgradeStrategy: Manual\n  config: |\n    whizard-telemetry-ruler:\n      auditingAlerting:\n        enabled: true\n      eventsAlerting:\n        enabled: true\n      loggingAlerting:\n        enabled: false\n      config:\n        sinks:\n        - name: alertmanager\n          type: webhook\n          config:\n            url: http://<ALERT_MANAGER_HOST>:31093/api/v1/alerts  # From Step 3\n  clusterScheduling:\n    placement:\n      clusters:\n        - <TARGET_CLUSTERS>\n```\n\n**Replace placeholders:**\n- `<VERSION>`: From Step 2 (e.g., `1.5.0`)\n- `<TARGET_CLUSTERS>`: User-confirmed cluster names\n- `<ALERT_MANAGER_HOST>`: From Step 3 (auto-detected or user-confirmed node IP)\n\n#### Enable Log Alerting Template\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: whizard-telemetry-ruler\n  namespace: kubesphere-system\nspec:\n  extension:\n    name: whizard-telemetry-ruler\n    version: <VERSION>  # From Step 2\n  enabled: true\n  upgradeStrategy: Manual\n  config: |\n    whizard-telemetry-ruler:\n      auditingAlerting:\n        enabled: true\n      eventsAlerting:\n        enabled: true\n      loggingAlerting:\n        enabled: true\n      config:\n        sinks:\n        - name: alertmanager\n          type: webhook\n          config:\n            url: http://<ALERT_MANAGER_HOST>:31093/api/v1/alerts  # From Step 3\n  clusterScheduling:\n    placement:\n      clusters:\n        - <TARGET_CLUSTERS>\n```\n\n#### Enable Alerting Persistence Template\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: whizard-telemetry-ruler\n  namespace: kubesphere-system\nspec:\n  extension:\n    name: whizard-telemetry-ruler\n    version: <VERSION>  # From Step 2\n  enabled: true\n  upgradeStrategy: Manual\n  config: |\n    global:\n       alertingPersistence:\n         enabled: true\n    whizard-telemetry-ruler:\n      config:\n        sinks:\n        - name: alertmanager\n          type: webhook\n          config:\n            url: http://<ALERT_MANAGER_HOST>:31093/api/v1/alerts  # From Step 3\n    alerting-persistence:\n      sinks:\n        opensearch:\n          enabled: true\n  clusterScheduling:\n    placement:\n      clusters:\n        - <TARGET_CLUSTERS>\n```\n\n## Configuration Parameters\n\n### Alerting Type Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `whizard-telemetry-ruler.auditingAlerting.enabled` | bool | true | Enable auditing alert |\n| `whizard-telemetry-ruler.eventsAlerting.enabled` | bool | true | Enable events alert |\n| `whizard-telemetry-ruler.loggingAlerting.enabled` | bool | false | Enable log alert |\n\n### Sink Configuration Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `whizard-telemetry-ruler.config.sinks[].name` | string | | Sink name |\n| `whizard-telemetry-ruler.config.sinks[].type` | string | | Sink type (webhook, etc.) |\n| `whizard-telemetry-ruler.config.sinks[].config.url` | string | | Webhook URL |\n\n### Alert Persistence Parameters (Optional)\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `global.alertingPersistence.enabled` | bool | false | Enable alert persistence |\n| `alerting-persistence.sinks.opensearch.enabled` | bool | false | Enable OpenSearch sink for alerts |\n| `alerting-persistence.sinks.opensearch.ism_policy.enable` | bool | true | Enable ISM policy |\n| `alerting-persistence.sinks.opensearch.ism_policy.min_index_age` | string | \"7d\" | Minimum index retention period |\n\n### Resource Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `whizard-telemetry-ruler.resources.limits.cpu` | string | 2       | ruler CPU limit |\n| `whizard-telemetry-ruler.resources.limits.memory` | string | 4Gi     | ruler memory limit |\n| `whizard-telemetry-ruler.resources.requests.cpu` | string | 100m    | ruler CPU request |\n| `whizard-telemetry-ruler.resources.requests.memory` | string | 20Mi    | ruler memory request |\n| `whizard-telemetry-ruler.kubectl.resources.limits.cpu` | string | 100m    | kubectl CPU limit |\n| `whizard-telemetry-ruler.kubectl.resources.limits.memory` | string | 256Mi   | kubectl memory limit |\n| `whizard-telemetry-ruler.kubectl.resources.requests.cpu` | string | 100m    | kubectl CPU request |\n| `whizard-telemetry-ruler.kubectl.resources.requests.memory` | string | 256Mi   | kubectl memory request |\n\n### Node Scheduling Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `whizard-telemetry-ruler.nodeSelector` | map | {} | Node selector |\n| `whizard-telemetry-ruler.tolerations` | list | [] | Tolerations |\n| `whizard-telemetry-ruler.affinity` | map | {} | Affinity |\n\n## Alerting Rule API\n\n### RuleGroup API (Namespaced)\n\n#### List RuleGroups\n\n```bash\ncurl -X GET \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/namespaces/<namespace>/rulegroups?clusterName=host\" \\\n  -H \"X-Remote-User: admin\"\n```\n\n#### Get RuleGroup\n\n```bash\ncurl -X GET \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/namespaces/<namespace>/rulegroups/<name>?clusterName=host\" \\\n  -H \"X-Remote-User: admin\"\n```\n\n#### Create RuleGroup\n\n```bash\ncurl -X POST \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/namespaces/<namespace>/rulegroups?clusterName=host\" \\\n  -H \"X-Remote-User: admin\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"apiVersion\": \"logging.whizard.io/v1alpha1\",\n    \"kind\": \"RuleGroup\",\n    \"metadata\": {\n      \"name\": \"<rulegroup-name>\",\n      \"namespace\": \"<namespace>\"\n    },\n    \"spec\": {\n      \"type\": \"events\",\n      \"rules\": [\n        {\n          \"name\": \"test-rule\",\n          \"desc\": \"Test rule\",\n          \"enable\": true,\n          \"expr\": {\n            \"kind\": \"rule\",\n            \"condition\": \"reason == \\\"FailedCreatePodSandBox\\\"\"\n          },\n          \"alerts\": {\n            \"severity\": \"warning\",\n            \"message\": \"Pod sandbox creation failed\",\n            \"labels\": {\n              \"alert\": \"test\"\n            },\n            \"annotations\": {\n              \"summary\": \"Pod sandbox creation failed\"\n            }\n          }\n        }\n      ]\n    }\n  }'\n```\n\n#### Update RuleGroup\n\n```bash\ncurl -X PUT \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/namespaces/<namespace>/rulegroups/<name>?clusterName=host\" \\\n  -H \"X-Remote-User: admin\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '<UPDATED_RULEGROUP>'\n```\n\n#### Delete RuleGroup\n\n```bash\ncurl -X DELETE \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/namespaces/<namespace>/rulegroups/<name>?clusterName=host\" \\\n  -H \"X-Remote-User: admin\"\n```\n\n### ClusterRuleGroup API (Cluster-scoped)\n\n#### List ClusterRuleGroups\n\n```bash\ncurl -X GET \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/clusterrulegroups?clusterName=host\" \\\n  -H \"X-Remote-User: admin\"\n```\n\n#### Get ClusterRuleGroup\n\n```bash\ncurl -X GET \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/clusterrulegroups/<name>?clusterName=host\" \\\n  -H \"X-Remote-User: admin\"\n```\n\n#### Create ClusterRuleGroup\n\n```bash\ncurl -X POST \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/clusterrulegroups?clusterName=host\" \\\n  -H \"X-Remote-User: admin\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"apiVersion\": \"logging.whizard.io/v1alpha1\",\n    \"kind\": \"ClusterRuleGroup\",\n    \"metadata\": {\n      \"name\": \"<clusterrulegroup-name>\"\n    },\n    \"spec\": {\n      \"type\": \"auditing\",\n      \"rules\": [\n        {\n          \"name\": \"audit-rule\",\n          \"desc\": \"Audit rule\",\n          \"enable\": true,\n          \"expr\": {\n            \"kind\": \"rule\",\n            \"condition\": \"verb == \\\"delete\\\"\"\n          },\n          \"alerts\": {\n            \"severity\": \"error\",\n            \"message\": \"Delete operation detected\",\n            \"labels\": {\n              \"type\": \"audit\"\n            }\n          }\n        }\n      ]\n    }\n  }'\n```\n\n#### Delete ClusterRuleGroup\n\n```bash\ncurl -X DELETE \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/clusterrulegroups/<name>?clusterName=host\" \\\n  -H \"X-Remote-User: admin\"\n```\n\n## Alert Query API\n\n### Query Alerts\n\nQuery alerts with filters and time range:\n\n```bash\ncurl -X POST \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/events.alerting.wiztelemetry.io/v1alpha1/query\" \\\n  -H \"X-Remote-User: admin\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"cluster\": \"host\",\n    \"startTime\": 1704067200,\n    \"endTime\": 1704153600,\n    \"from\": 0,\n    \"size\": 10,\n    \"order\": \"descending\",\n    \"parameters\": [\n      {\n        \"field\": \"severity\",\n        \"operator\": \"=\",\n        \"value\": \"error\"\n      },\n      {\n        \"field\": \"alertname\",\n        \"operator\": \"?\",\n        \"values\": [\"pod*\"]\n      }\n    ]\n  }'\n```\n\n### Query Statistics\n\nGet alert statistics (overview, histogram, by severity, etc.):\n\n```bash\ncurl -X POST \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/events.alerting.wiztelemetry.io/v1alpha1/statistics\" \\\n  -H \"X-Remote-User: admin\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"cluster\": \"host\",\n    \"statisticsType\": 501,\n    \"startTime\": 1704067200,\n    \"endTime\": 1704153600\n  }'\n```\n\n### Alert Query Parameters\n\n| Parameter | Type | Required | Description |\n|-----------|------|----------|-------------|\n| `cluster` | string | Yes | Cluster name (e.g., host, member-1) |\n| `startTime` | int64 | No | Start time (Unix timestamp), default: 30 days ago |\n| `endTime` | int64 | No | End time (Unix timestamp), default: now |\n| `from` | int64 | No | Offset for pagination, default: 0 |\n| `size` | int64 | No | Number of results, default: 10 |\n| `order` | string | No | Sort order: \"ascending\" or \"descending\", default: descending |\n| `statisticsType` | int | No | Statistics type (see Statistics Type Values) |\n| `parameters` | array | No | Filter parameters |\n\n### Filter Parameter Structure\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `field` | string | Field name to filter on |\n| `operator` | string | Operator (see Filter Operators) |\n| `value` | interface{} | Single value for =, !=, >, >=, <, <= |\n| `values` | array | Multiple values for In, NotIn, ?, !?, ~, !~ |\n\n### Filter Operators\n\n| Operator | Symbol | Description |\n|----------|--------|-------------|\n| Equals | = | Exact match |\n| NotEquals | != | Not equal |\n| Greater | > | Greater than |\n| GreaterOrEqual | >= | Greater or equal |\n| Less | < | Less than |\n| LessOrEqual | <= | Less or equal |\n| In | In | In list |\n| NotIn | NotIn | Not in list |\n| MatchesFuzzy | ? | Fuzzy match (supports * and ?) |\n| NotMatchesFuzzy | !? | Not fuzzy match |\n| MatchesRegex | ~ | Regex match |\n| NotMatchesRegex | !~ | Not regex match |\n| Exists | Exists | Field exists |\n| NotExists | NotExists | Field does not exist |\n\n### Statistics Type Values\n\n| Type | Value | Description |\n|------|-------|-------------|\n| StatisticsEventsAlertingNone | 500 | No statistics |\n| StatisticsEventsAlertingDateHistogram | 501 | Time histogram |\n| StatisticsEventsAlertingOverview | 502 | Overview count |\n| StatisticsEventsAlertingByNamespace | 503 | By namespace |\n| StatisticsEventsAlertingByRuleGroup | 504 | By rule group |\n| StatisticsEventsAlertingByAlertName | 505 | By alert name |\n| StatisticsEventsAlertingByAlertType | 506 | By alert type |\n| StatisticsEventsAlertingBySeverity | 507 | By severity |\n\n### Available Alert Fields\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `alertname` | string | Alert name |\n| `severity` | string | Alert severity (info, warning, error, critical) |\n| `namespace` | string | Namespace |\n| `rulegroup` | string | Rule group name |\n| `cluster` | string | Cluster name |\n| `rulekind` | string | Rule kind (RuleGroup, ClusterRuleGroup) |\n| `ruletype` | string | Rule type (events, auditing, logs) |\n| `alerttype` | string | Alert type |\n| `labels` | string | Alert labels (JSON string) |\n| `annotations` | string | Alert annotations (JSON string) |\n| `firing` | bool | Is firing |\n| `pending` | bool | Is pending |\n| `inhibited` | bool | Is inhibited |\n| `silenced` | bool | Is silenced |\n| `startsat` | int64 | Start timestamp |\n| `endsat` | int64 | End timestamp |\n| `updatedat` | int64 | Update timestamp |\n\n### Alert Query Examples\n\n#### Query by Severity\n\n```json\n{\n  \"cluster\": \"host\",\n  \"parameters\": [\n    {\n      \"field\": \"severity\",\n      \"operator\": \"=\",\n      \"value\": \"error\"\n    }\n  ],\n  \"size\": 20\n}\n```\n\n#### Query by Time Range\n\n```json\n{\n  \"cluster\": \"host\",\n  \"startTime\": 1704067200,\n  \"endTime\": 1704153600,\n  \"size\": 100\n}\n```\n\n#### Query by Namespace and RuleGroup\n\n```json\n{\n  \"cluster\": \"host\",\n  \"parameters\": [\n    {\n      \"field\": \"namespace\",\n      \"operator\": \"=\",\n      \"value\": \"default\"\n    },\n    {\n      \"field\": \"rulegroup\",\n      \"operator\": \"=\",\n      \"value\": \"my-rule-group\"\n    }\n  ]\n}\n```\n\n#### Fuzzy Match Alert Name\n\n```json\n{\n  \"cluster\": \"host\",\n  \"parameters\": [\n    {\n      \"field\": \"alertname\",\n      \"operator\": \"?\",\n      \"values\": [\"pod*\", \"container*\"]\n    }\n  ]\n}\n```\n\n#### Query with Statistics\n\n```json\n{\n  \"cluster\": \"host\",\n  \"startTime\": 1704067200,\n  \"endTime\": 1704153600,\n  \"statisticsType\": 507\n}\n```\n\n### RuleGroup API Query Parameters\n\n| Parameter | Type | Description |\n|-----------|------|-------------|\n| `cluster` | string | Cluster name, empty means host cluster |\n| `name` | string | Name used for filtering |\n| `labelSelector` | string | Label selector used for filtering |\n| `status` | string | Filter by enabled status (true or false) |\n| `builtin` | string | Filter by builtin status (true or false) |\n| `type` | string | Filter by type (logs, events, auditing) |\n| `page` | int | Page number |\n| `limit` | int | Items per page |\n| `orderBy` | string | Sort parameter (e.g., createTime) |\n| `ascending` | bool | Sort order |\n\n### Rule Type Values\n\n| Type | Description |\n|------|-------------|\n| `events` | K8s native events |\n| `auditing` | K8s/KubeSphere auditing events |\n| `logs` | K8s container logs |\n\n### Alert Severity Values\n\n| Severity | Description |\n|----------|-------------|\n| `info` | Informational |\n| `warning` | Warning |\n| `error` | Error |\n| `critical` | Critical |\n\n### Rule Expression Kind Values\n\n| Kind | Description |\n|------|-------------|\n| `rule` | Regular rule with condition |\n| `macro` | Macro rule |\n| `list` | List rule |\n| `alias` | Alias rule |\n\n### Condition Detailed Explanation\n\nThe `condition` field is used to filter events/logs/auditing that match specific criteria. It supports various operators and field references.\n\n#### Operators\n\n| Operator | Description | Example |\n|----------|-------------|---------|\n| `==` | Equals | `reason == \"FailedCreatePodSandBox\"` |\n| `!=` | Not equals | `verb != \"delete\"` |\n| `=~` | Regex match | `message =~ \"error.*failed\"` |\n| `!~` | Not regex match | `message !~ \"debug\"` |\n| `&&` | AND | `reason == \"Failed\" && type == \"Warning\"` |\n| `\\|\\|` | OR | `reason == \"Failed\" \\|\\| reason == \"Error\"` |\n\n#### Available Fields by Type\n\n##### Events Type (`type: events`)\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `reason` | string | Event reason (e.g., FailedCreatePodSandBox) |\n| `type` | string | Event type (Normal, Warning) |\n| `involvedObject.kind` | string | Object kind (Pod, Deployment, etc.) |\n| `involvedObject.name` | string | Object name |\n| `involvedObject.namespace` | string | Object namespace |\n| `message` | string | Event message |\n| `source` | string | Event source component |\n| `count` | int | Event count |\n\n**Events Examples:**\n```json\n// Alert when pod sandbox creation fails\n\"condition\": \"reason == \\\"FailedCreatePodSandBox\\\"\"\n\n// Alert on warning events for specific namespace\n\"condition\": \"type == \\\"Warning\\\" && involvedObject.namespace == \\\"default\\\"\"\n\n// Alert when event count exceeds threshold\n\"condition\": \"count >= 5\"\n```\n\n##### Auditing Type (`type: auditing`)\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `verb` | string | HTTP verb (get, post, put, delete, etc.) |\n| `user` | string | Username |\n| `sourceIPs` | string | Source IP addresses |\n| `resource.group` | string | Resource API group |\n| `resource.version` | string | Resource API version |\n| `resource.resource` | string | Resource type (pods, deployments, etc.) |\n| `objectRef.name` | string | Object name |\n| `objectRef.namespace` | string | Object namespace |\n| `responseStatus.code` | int | HTTP response code |\n| `level` | string | Audit level (None, Metadata, Request, RequestResponse) |\n\n**Auditing Examples:**\n```json\n// Alert on delete operations\n\"condition\": \"verb == \\\"delete\\\"\"\n\n// Alert on failed requests (4xx/5xx)\n\"condition\": \"responseStatus.code >= 400\"\n\n// Alert on specific user activity\n\"condition\": \"user == \\\"admin\\\" && verb == \\\"delete\\\"\"\n\n// Alert on sensitive resources\n\"condition\": \"resource.resource == \\\"secrets\\\"\"\n```\n\n##### Logs Type (`type: logs`)\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `log` | string | Log message content |\n| `container` | string | Container name |\n| `pod` | string | Pod name |\n| `namespace` | string | Namespace name |\n| `cluster` | string | Cluster name |\n\n**Logs Examples:**\n```json\n// Alert on error keyword\n\"condition\": \"log contains \\\"error\\\"\"\n\n// Alert on specific container\n\"condition\": \"container == \\\"nginx\\\"\"\n\n// Alert on OOM kills\n\"condition\": \"log contains \\\"OOMKilled\\\"\"\n\n// Alert on multiple keywords\n\"condition\": \"log contains \\\"failed\\\" && log contains \\\"connection\\\"\"\n\n// Alert using regex\n\"condition\": \"log =~ \\\"error.*timeout|timeout.*error\\\"\"\n```\n\n#### Macro Usage\n\nMacros allow reusable expressions:\n\n```json\n{\n  \"expr\": {\n    \"kind\": \"macro\",\n    \"macro\": \"high_error_rate\"\n  }\n}\n```\n\n#### List Usage\n\nLists allow grouping values:\n\n```json\n{\n  \"expr\": {\n    \"kind\": \"list\",\n    \"list\": [\"error\", \"warning\", \"critical\"]\n  }\n}\n```\n\n#### Alias Usage\n\nAliases provide descriptive names for complex expressions:\n\n```json\n{\n  \"expr\": {\n    \"kind\": \"alias\",\n    \"alias\": \"Pod_Sandbox_Failure\"\n  }\n}\n```\n\n### Sliding Window Alert (Log Alerting)\n\nFor log alerting with sliding window:\n\n```json\n{\n  \"name\": \"log-rate-rule\",\n  \"desc\": \"Log rate alert\",\n  \"enable\": true,\n  \"expr\": {\n    \"kind\": \"rule\",\n    \"condition\": \"log contains \\\"error\\\"\"\n  },\n  \"alerts\": {\n    \"severity\": \"error\",\n    \"message\": \"High error log rate\"\n  },\n  \"slidingWindow\": {\n    \"windowSize\": \"5m\",\n    \"slidingInterval\": \"1m\",\n    \"count\": 100\n  }\n}\n```\n\n| Parameter | Type | Description |\n|-----------|------|-------------|\n| `slidingWindow.windowSize` | string | Window size (e.g., \"300ms\", \"5m\") |\n| `slidingWindow.slidingInterval` | string | Slide step (must be less than windowSize) |\n| `slidingWindow.count` | int | Count threshold to trigger alert |\n\n## Extension Operations\n\n### Check Extension Status\n\n```bash\nkubectl get installplan whizard-telemetry-ruler\nkubectl get extensionversions -l kubesphere.io/extension-ref=whizard-telemetry-ruler\n```\n\n### Uninstall Extension\n\n**Uninstall from all clusters:**\n\n```bash\nkubectl delete installplan whizard-telemetry-ruler\n```\n\n**Uninstall from specific cluster:**\n\nTo remove WizTelemetry Ruler from a specific cluster, update the InstallPlan by removing that cluster from `clusterScheduling.placement.clusters`:\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: whizard-telemetry-ruler\n  namespace: kubesphere-system\nspec:\n  extension:\n    name: whizard-telemetry-ruler\n    version: <VERSION>\n  enabled: true\n  upgradeStrategy: Manual\n  clusterScheduling:\n    placement:\n      clusters:\n        - <REMAINING_CLUSTERS>  # Remove the cluster you want to uninstall from\n```\n\n## Alert Notification Configuration\n\nTo send alerts through WizTelemetry Notification extension, configure the sink URL to point to the `alertmanager-proxy` service.\n\n**Auto-detection (recommended):** Use the command from Step 3 to get the host node IP automatically.\n\n```yaml\nwhizard-telemetry-ruler:\n  config:\n    sinks:\n    - name: alertmanager\n      type: webhook\n      config:\n        url: http://<ALERT_MANAGER_HOST>:31093/api/v1/alerts\n```\n\n- `<ALERT_MANAGER_HOST>`: From Step 3 (auto-detected or user-confirmed)\n- Default NodePort: 31093\n- Service: `alertmanager-proxy` in `kubesphere-system` namespace","tags":["whizard","telemetry","ruler","kubesphere","agent-skills","cloud-native","cncf","devops","ebpf","hacktoberfest","kubernetes","llm"],"capabilities":["skill","source-kubesphere","skill-whizard-telemetry-ruler","topic-agent-skills","topic-cloud-native","topic-cncf","topic-devops","topic-ebpf","topic-hacktoberfest","topic-kubernetes","topic-kubesphere","topic-llm","topic-multi-cluster","topic-multi-tenancy","topic-observability"],"categories":["kubesphere"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/kubesphere/kubesphere/whizard-telemetry-ruler","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add kubesphere/kubesphere","source_repo":"https://github.com/kubesphere/kubesphere","install_from":"skills.sh"}},"qualityScore":"0.700","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 16934 github stars · SKILL.md body (25,802 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:52:40.785Z","embedding":null,"createdAt":"2026-04-27T06:52:20.245Z","updatedAt":"2026-05-18T18:52:40.785Z","lastSeenAt":"2026-05-18T18:52:40.785Z","tsv":"'-1':328,1382 '/extension-ref=whizard-telemetry-ruler':317,2306 '/kapis/events.alerting.wiztelemetry.io/v1alpha1/query':1294 '/kapis/events.alerting.wiztelemetry.io/v1alpha1/statistics':1346 '/kapis/logging.whizard.io/v1alpha1/clusterrulegroups/':1192,1267 '/kapis/logging.whizard.io/v1alpha1/clusterrulegroups?clustername=host':1177,1209 '/kapis/logging.whizard.io/v1alpha1/namespaces/':1025,1043,1061,1130,1154 '/rulegroups':1026,1044,1062,1131,1155 '/v1alpha1':578,639,728,793,1080,1225,2346 '0':401,1314,1410 '1':197 '1.1':214 '1.2':227 '1.5.0':335,702 '10':1316,1418 '100':1691,2260 '100m':960,972,984 '1704067200':1310,1364,1687,1735 '1704153600':1312,1366,1689,1737 '1m':2258 '2':247,268,289,601,662,700,751,816,948 '20':1678 '20mi':966 '256mi':978,990 '3':347,498,622,692,710,781,841,2413,2437 '3.1':388 '3.2':407 '30':1391 '300ms':2269 '31093':386,425,2447 '31093/api/v1/alerts':428,443,619,689,778,838,2434 '400':2079 '4gi':954 '4xx/5xx':2076 '5':1999 '500':1541 '501':1362,1545 '502':1549 '503':1553 '504':1557 '505':1562 '506':1567 '507':1572,1739 '5m':2256,2270 '7d':935 'activ':2084 'actual':561 'add':537 'address':405,2023 'admin':1034,1052,1070,1139,1163,1183,1200,1215,1275,1300,1352,2087 'affin':1010 'age':933 'ago':1393 'alert':17,37,40,45,66,88,92,100,115,133,144,155,165,173,181,365,426,437,633,722,786,843,854,866,872,878,903,915,924,1011,1105,1114,1249,1276,1280,1282,1333,1367,1564,1569,1576,1583,1587,1620,1624,1630,1662,1716,1830,1970,1979,1991,2065,2072,2080,2090,2128,2136,2143,2151,2162,2218,2220,2223,2236,2246,2286,2382,2387 'alerting-persist':842 'alerting-persistence.sinks.opensearch.enabled':917 'alerting-persistence.sinks.opensearch.ism_policy.enable':925 'alerting-persistence.sinks.opensearch.ism_policy.min':931 'alertingpersist':823 'alertmanag':72,349,368,372,416,420,423,494,573,614,684,773,833,2401,2429,2450 'alertmanager-proxi':371,2400,2449 'alertnam':1326,1581,1723 'alerttyp':1618 'alia':1860,1861,2199,2211,2212 'alias':2201 'allow':2174,2188 'annot':1116,1628,1631 'api':97,1013,1015,1165,1278,1741,2027,2032 'apivers':575,636,725,790,1077,1222,2343 'application/json':1075,1144,1220,1305,1357 'array':1439,1468 'ascend':1424,1809 'ask':255,269,411 'audit':52,137,140,143,865,1232,1236,1239,1258,1616,1793,1822,1824,2000,2003,2056,2062 'audit-rul':1235 'auditingalert':672,761 'auto':712,2405,2439 'auto-detect':711,2404,2438 'automat':2420 'avail':199,216,274,1575,1916 'base':483 'bash':218,306,394,1019,1037,1055,1124,1148,1171,1186,1203,1261,1288,1340,2292,2313 'basic':569 'bool':862,868,874,912,918,926,1635,1639,1643,1647,1810 'builtin':1777,1781 'capabl':41 'check':2289 'cluster':200,210,217,221,230,236,242,254,260,275,279,379,488,492,625,695,706,784,851,1167,1307,1359,1374,1377,1601,1603,1669,1684,1698,1719,1732,1747,1749,1754,2121,2123,2312,2324,2332,2339,2373,2376 'cluster-scop':1166 'clusternam':1027,1045,1063,1132,1156,1193,1268 'clusterrulegroup':1164,1170,1185,1202,1227,1260,1610 'clusterschedul':623,693,782,849,2371 'clusterscheduling.placement.clusters':2341 'code':2053 'command':2410 'complet':188,477 'complex':2206 'compon':28,102,103,113,1962 'condit':1102,1246,1853,1863,1867,1976,1986,1997,2069,2077,2085,2094,2132,2140,2147,2155,2165,2242 'config':518,527,606,611,617,667,681,687,756,770,776,821,830,836,2426,2432 'config.url':899 'configur':16,79,93,352,362,500,538,629,852,880,2384,2392 'confirm':202,258,408,414,441,491,705,717,2444 'connect':2161 'contain':1727,1828,2109,2111,2134,2139,2141,2149,2157,2160,2244 'content':1073,1142,1218,1303,1355,2108 'content-typ':1072,1141,1217,1302,1354 'core':111 'count':1551,1963,1966,1994,1998,2259,2282 'cpu':950,962,974,986 'creat':84,1053,1201 'createtim':1808 'creation':1111,1120,1974 'criteria':1877 'critic':204,502,517,554,1592,1841,1842,2198 'curl':1020,1038,1056,1125,1149,1172,1187,1204,1262,1289,1341 'custom':628 'd':1076,1145,1221,1306,1358 'data':60,63,168 'day':1392 'debug':1905 'default':105,384,859,884,909,944,999,1390,1401,1409,1417,1427,1705,1990,2445 'defin':44 'delet':87,1146,1151,1248,1253,1259,1264,1895,2014,2067,2071,2089,2315 'depend':117 'deploy':262,284,375,1944,2039 'desc':1094,1238,2233 'descend':1318,1426,1428 'descript':104,860,885,910,945,1000,1373,1448,1478,1539,1580,1746,1817,1834,1848,1887,1926,2006,2103,2203,2263 'detail':1864 'detect':419,422,713,1255,2406,2440 'determin':212,228 'dev':277 'differ':451 'direct':243 'e.g':334,701,1379,1807,1931,2268 'empti':1751 'enabl':106,135,146,157,176,184,602,663,673,676,679,720,752,762,765,768,785,817,824,847,864,870,876,914,920,928,1097,1241,1772,2237,2367 'end':324,1397,1656 'endsat':1654 'endtim':1311,1365,1394,1688,1736 'ensur':465 'equal':1479,1484,1491,1498,1889,1893 'error':1251,1324,1591,1676,1839,1840,1899,1915,2130,2135,2167,2170,2183,2196,2245,2248,2251 'etc':73,897,1339,1945,2015,2040 'evalu':57 'event':36,50,53,59,126,129,132,871,1088,1615,1792,1818,1821,1825,1920,1923,1929,1935,1956,1960,1965,1967,1982,1993 'events/logs/auditing':1873 'eventsalert':675,764 'exact':529,1480 'exampl':1664,1888,1968,2063,2126 'exceed':1995 'exist':1524,1525,1527,1533 'explan':1865 'explicit':233 'expos':381 'expr':1099,1243,2178,2192,2209,2239 'express':1844,2176,2207 'extens':11,27,83,464,592,653,742,807,2287,2290,2308,2360,2391 'extensionvers':309,2302 'fail':1112,1121,1900,1908,1913,1975,2074,2158 'failedcreatepodsandbox':1104,1891,1932,1978 'failur':2215 'fals':680,875,913,919,1776,1785 'field':519,539,1320,1325,1446,1449,1451,1526,1530,1577,1578,1672,1701,1706,1722,1868,1883,1917,1924,2004,2101 'filter':1284,1441,1443,1454,1460,1474,1760,1767,1770,1779,1788,1872 'fire':1634,1637 'format':522 'fuzzi':1509,1515,1714 'generat':194 'get':198,215,220,290,302,308,348,389,396,1022,1035,1040,1174,1184,1189,1332,2011,2294,2301,2415 'global':822 'global.alertingpersistence.enabled':911 'greater':1485,1486,1489 'greaterorequ':1488 'group':1560,1599,1713,2028,2189 'h':1029,1047,1065,1071,1134,1140,1158,1178,1195,1210,1216,1270,1295,1301,1347,1353 'hierarchi':553 'high':2182,2250 'histogram':1336,1547 'host':276,350,378,391,417,421,1028,1046,1064,1133,1157,1194,1269,1308,1360,1380,1670,1685,1699,1720,1733,1753,2417 'http':2009,2051 'import':476 'includ':14 'incom':58 'index':932,937 'info':1589,1835 'inform':1836 'inhibit':1642,1645 'instal':15,77,185,468,470,473,570,626 'installplan':195,345,503,580,641,730,795,2295,2316,2335,2348 'int':1430,1795,1799,1964,2050,2281 'int64':1384,1395,1404,1412,1651,1655,1659 'interfac':1463 'internalip':404 'involvedobject.kind':1939 'involvedobject.name':1946 'involvedobject.namespace':1950,1989 'ip':393,418,719,2022,2419 'ism':929 'item':224,321,400,1800 'json':1626,1632,1668,1683,1697,1718,1731,1969,2064,2127,2177,2191,2208,2227 'jsonpath':223,319,399 'k8s':48,55,1819,1827 'k8s/kubesphere':51,1823 'keyword':2131,2154 'kill':2146 'kind':579,640,729,794,1081,1100,1226,1244,1608,1845,1847,1942,2179,2193,2210,2240,2347 'kubectl':219,307,395,973,979,985,991,2293,2300,2314 'kubespher':13,31,312,589,650,739,804,2357,2454 'kubesphere-system':311,588,649,738,803,2356,2453 'kubesphere.io':316,577,638,727,792,2305,2345 'kubesphere.io/extension-ref=whizard-telemetry-ruler':315,2304 'kubesphere.io/v1alpha1':576,637,726,791,2344 'l':314,2303 'label':1113,1256,1622,1625,1763 'labelselector':1761 'latest':291,304,332 'leav':565 'less':1492,1493,1496,2277 'lessorequ':1495 'level':2054,2057 'limit':951,957,975,981,1798 'list':1006,1017,1169,1502,1507,1857,1858,2185,2187,2194,2195 'll':340 'log':39,56,62,148,151,154,721,877,1617,1791,1826,1829,2097,2100,2104,2106,2125,2133,2148,2156,2159,2166,2219,2222,2230,2234,2243,2252 'log-rate-rul':2229 'logging.whizard.io':1079,1224 'logging.whizard.io/v1alpha1':1078,1223 'loggingalert':678,767 'macro':1854,1855,2171,2173,2180,2181 'manag':19,91,99 'manual':605,666,755,820,2370 'map':1002,1009 'match':1481,1510,1516,1519,1523,1715,1875,1897,1903 'matchesfuzzi':1508 'matchesregex':1517 'mean':1752 'member':1381 'memori':956,968,980,992 'messag':1108,1252,1898,1904,1954,1957,2107,2249 'metadata':581,642,731,796,1083,1228,2059,2349 'metadata.name':225,504 'minimum':936 'modifi':549 'multipl':1469,2153 'must':298,505,524,557,2275 'my-rule-group':1710 'n':310,323 'name':493,516,582,593,613,643,654,683,707,732,743,772,797,808,832,887,890,1084,1090,1229,1234,1378,1452,1565,1584,1600,1604,1717,1750,1755,1757,1949,2044,2112,2116,2120,2124,2204,2228,2350,2361,2428 'namespac':587,648,737,802,1016,1085,1555,1593,1595,1694,1702,1953,1985,2048,2117,2119,2355,2456 'nativ':49,1820 'need':360 'nginx':2142 'node':392,397,718,994,1003,2418 'nodeport':383,2446 'none':2058 'normal':1937 'note':336,459 'notequ':1482 'notexist':1528,1529 'notif':159,162,166,366,438,463,2383,2390 'notin':1473,1503,1504 'notmatchesfuzzi':1513 'notmatchesregex':1520 'number':1414,1797 'o':222,318,398 'object':1941,1948,1952,2043,2047 'objectref.name':2041 'objectref.namespace':2045 'observ':32 'offset':1406 'oom':2145 'oomkil':2150 'opensearch':177,178,846,921 'oper':1254,1322,1327,1456,1458,1461,1475,1476,1674,1703,1708,1724,1881,1885,1886,2068,2288 'option':163,906 'order':192,1317,1419,1423,1812 'orderbi':1803 'output':330 'overview':22,1335,1550 'page':1794,1796,1802 'pagin':1408 'paramet':853,856,857,881,882,905,907,941,942,996,997,1319,1369,1370,1438,1442,1444,1671,1700,1721,1743,1744,1806,2261 'pend':1638,1641 'per':1801 'perform':355 'period':939 'persist':174,182,787,844,904,916 'pipelin':169 'placehold':556,568,697 'placement':624,694,783,850,2372 'platform':33,119 'pod':1109,1118,1329,1726,1943,1972,2038,2113,2115,2213 'point':2397 'polici':930 'port':385,424 'post':1058,1206,1291,1343,2012 'prerequisit':186,478 'proceed':207,244,265 'provid':35,295,450,2202 'proxi':369,373,2402,2451 'put':1127,2013 'queri':1277,1279,1281,1330,1368,1663,1665,1679,1692,1728,1742 'rang':320,1287,1682 'rate':2184,2231,2235,2253 'reason':1103,1890,1907,1912,1914,1927,1930,1977 'receiv':69 'recommend':2407 'refer':1884 'regex':1518,1522,1896,1902,2164 'regular':1850 'remot':1032,1050,1068,1137,1161,1181,1198,1213,1273,1298,1350 'remov':2326,2337,2374 'replac':559,696 'request':239,963,969,987,993,2060,2075 'requestrespons':2061 'requir':124,130,141,152,171,179,187,1372 'resourc':940,2026,2031,2036,2093 'resource.group':2024 'resource.resource':2034,2095 'resource.version':2029 'respons':2052 'responsestatus.code':2049,2078 'result':1416 'retent':938 'reusabl':2175 'rule':18,46,89,101,1012,1089,1093,1096,1101,1233,1237,1240,1245,1559,1598,1607,1613,1712,1813,1843,1849,1851,1856,1859,1862,2232,2241 'rulegroup':1014,1018,1036,1054,1082,1123,1147,1596,1609,1696,1707,1740 'rulegroup/clusterrulegroup':90 'rulekind':1605 'ruler':4,10,21,24,82,96,110,112,286,472,475,510,586,597,610,647,658,671,736,747,760,801,812,829,949,955,961,967,2299,2320,2328,2354,2365,2425 'ruletyp':1611 'sandbox':1110,1119,1973,2214 'schedul':995 'scope':1168 'secret':2096 'see':1434,1459 'select':486 'selector':1004,1764 'send':65,2386 'sensit':2092 'servic':120,370,2403,2448 'sever':1106,1250,1321,1338,1574,1585,1588,1667,1673,1831,1833,2247 'shown':531,543 'silenc':1646,1649 'singl':1464 'sink':353,363,446,501,612,682,771,831,845,879,889,894,922,2394,2427 'size':1315,1411,1677,1690,2267 'skill' 'skill-whizard-telemetry-ruler' 'slide':2216,2225,2273 'slidinginterv':2257 'slidingwindow':2254 'slidingwindow.count':2280 'slidingwindow.slidinginterval':2271 'slidingwindow.windowsize':2264 'sort':325,1422,1805,1811 'sourc':1958,1961,2021 'source-kubesphere' 'sourceip':2019 'spec':591,652,741,806,1086,1230,2359 'spec.version':322 'specif':1876,1984,2082,2138,2323,2331 'specifi':68,234,252,273,457 'start':1386,1652 'startsat':1650 'starttim':1309,1363,1383,1686,1734 'statist':1331,1334,1432,1435,1534,1543,1730 'statisticseventsalertingbyalertnam':1561 'statisticseventsalertingbyalerttyp':1566 'statisticseventsalertingbynamespac':1552 'statisticseventsalertingbyrulegroup':1556 'statisticseventsalertingbysever':1571 'statisticseventsalertingdatehistogram':1544 'statisticseventsalertingnon':1540 'statisticseventsalertingoverview':1548 'statisticstyp':1361,1429,1738 'status':1768,1773,1782,2291 'status.addresses':402 'step':190,196,213,226,246,267,288,346,357,387,406,479,482,497,600,621,661,691,699,709,750,780,815,840,2274,2412,2436 'string':888,893,900,934,947,953,959,965,971,977,983,989,1375,1420,1450,1457,1582,1586,1594,1597,1602,1606,1612,1619,1623,1627,1629,1633,1748,1756,1762,1769,1778,1787,1804,1928,1934,1940,1947,1951,1955,1959,2008,2017,2020,2025,2030,2035,2042,2046,2055,2105,2110,2114,2118,2122,2265,2272 'structur':528,551,1445 'summari':1117 'support':1511,1879 'symbol':1477 'system':313,590,651,740,805,2358,2455 'tail':327 'target':203,209,229,235,253,487 'telemetri':3,109,123,509,585,596,609,646,657,670,735,746,759,800,811,828,2298,2319,2353,2364,2424 'templat':534,546,571,630,723,788 'test':1092,1095,1115 'test-rul':1091 'threshold':1996,2283 'time':1286,1387,1398,1546,1681 'timeout':2168,2169 'timestamp':1389,1400,1653,1657,1661 'toler':1007 'topic-agent-skills' 'topic-cloud-native' 'topic-cncf' 'topic-devops' 'topic-ebpf' 'topic-hacktoberfest' 'topic-kubernetes' 'topic-kubesphere' 'topic-llm' 'topic-multi-cluster' 'topic-multi-tenancy' 'topic-observability' 'trigger':2285 'true':116,603,664,674,677,753,763,766,769,818,825,848,863,869,927,1098,1242,1774,1783,2238,2368 'type':403,615,634,685,774,834,855,858,883,892,895,908,943,998,1074,1087,1143,1219,1231,1257,1304,1356,1371,1433,1436,1447,1535,1537,1570,1579,1614,1621,1745,1786,1790,1814,1816,1909,1919,1921,1922,1925,1933,1936,1987,2001,2002,2005,2037,2098,2099,2102,2262,2430 'uninstal':2307,2309,2321,2380 'unix':1388,1399 'updat':85,1122,1660,2333 'updatedat':1658 'upgradestrategi':604,665,754,819,2369 'url':427,435,447,452,458,495,618,688,777,837,902,2395,2433 'usag':2172,2186,2200 'use':5,76,94,240,341,433,442,453,461,513,525,1758,1765,1870,2163,2408 'user':232,249,256,270,297,410,412,440,449,456,490,704,716,1033,1051,1069,1138,1162,1182,1199,1214,1274,1299,1351,2016,2083,2086,2443 'user-confirm':489,703,715,2442 'user-specifi':455 'usernam':2018 'v':326 'valu':562,1323,1328,1437,1462,1465,1467,1470,1536,1538,1675,1704,1709,1725,1815,1832,1846,2190 'various':1880 'vector':170 'verb':1247,1894,2007,2010,2070,2088 'version':292,305,333,598,659,748,813,2033,2366 'via':382 'want':282,431,2378 'warn':1107,1590,1837,1838,1910,1938,1981,1988,2197 'webhook':616,686,775,835,896,901,2431 'whizard':2,108,122,128,139,150,161,508,584,595,608,645,656,669,734,745,758,799,810,827,2297,2318,2352,2363,2423 'whizard-audit':138 'whizard-ev':127 'whizard-log':149 'whizard-notif':160 'whizard-telemetri':121 'whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80':1024,1042,1060,1129,1153,1176,1191,1208,1266,1293,1345 'whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/events.alerting.wiztelemetry.io/v1alpha1/query':1292 'whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/events.alerting.wiztelemetry.io/v1alpha1/statistics':1344 'whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/clusterrulegroups/':1190,1265 'whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/clusterrulegroups?clustername=host':1175,1207 'whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.whizard.io/v1alpha1/namespaces/':1023,1041,1059,1128,1152 'whizard-telemetry-rul':1,107,507,583,594,607,644,655,668,733,744,757,798,809,826,2296,2317,2351,2362,2422 'whizard-telemetry-ruler.affinity':1008 'whizard-telemetry-ruler.auditingalerting.enabled':861 'whizard-telemetry-ruler.config.sinks':886,891,898 'whizard-telemetry-ruler.eventsalerting.enabled':867 'whizard-telemetry-ruler.kubectl.resources.limits.cpu':970 'whizard-telemetry-ruler.kubectl.resources.limits.memory':976 'whizard-telemetry-ruler.kubectl.resources.requests.cpu':982 'whizard-telemetry-ruler.kubectl.resources.requests.memory':988 'whizard-telemetry-ruler.loggingalerting.enabled':873 'whizard-telemetry-ruler.nodeselector':1001 'whizard-telemetry-ruler.resources.limits.cpu':946 'whizard-telemetry-ruler.resources.limits.memory':952 'whizard-telemetry-ruler.resources.requests.cpu':958 'whizard-telemetry-ruler.resources.requests.memory':964 'whizard-telemetry-ruler.tolerations':1005 'window':2217,2226,2266 'windows':2255,2279 'wiztelemetri':9,20,23,81,118,125,136,147,158,167,285,462,471,474,2327,2389 'work':7 'x':1021,1031,1039,1049,1057,1067,1126,1136,1150,1160,1173,1180,1188,1197,1205,1212,1263,1272,1290,1297,1342,1349 'x-remote-us':1030,1048,1066,1135,1159,1179,1196,1211,1271,1296,1348 'yaml':521,574,635,724,789,2342,2421 'yes':1376","prices":[{"id":"9ce5916b-052f-405f-93e8-348888239091","listingId":"8bde6baa-f7ca-4c76-943b-356eae20e04f","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"kubesphere","category":"kubesphere","install_from":"skills.sh"},"createdAt":"2026-04-27T06:52:20.245Z"}],"sources":[{"listingId":"8bde6baa-f7ca-4c76-943b-356eae20e04f","source":"github","sourceId":"kubesphere/kubesphere/whizard-telemetry-ruler","sourceUrl":"https://github.com/kubesphere/kubesphere/tree/master/skills/whizard-telemetry-ruler","isPrimary":false,"firstSeenAt":"2026-04-27T06:52:20.245Z","lastSeenAt":"2026-05-18T18:52:40.785Z"}],"details":{"listingId":"8bde6baa-f7ca-4c76-943b-356eae20e04f","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"kubesphere","slug":"whizard-telemetry-ruler","github":{"repo":"kubesphere/kubesphere","stars":16934,"topics":["agent-skills","ai","cloud-native","cncf","devops","ebpf","hacktoberfest","kubernetes","kubesphere","llm","multi-cluster","multi-tenancy","observability","servicemesh","skills","skills-sh","skillsmp"],"license":"other","html_url":"https://github.com/kubesphere/kubesphere","pushed_at":"2026-05-06T07:16:53Z","description":"The container platform tailored for Kubernetes multi-cloud, datacenter, and edge management ⎈ 🖥 ☁️","skill_md_sha":"fb152fd392f365edb51f5369292451c0701cc647","skill_md_path":"skills/whizard-telemetry-ruler/SKILL.md","default_branch":"master","skill_tree_url":"https://github.com/kubesphere/kubesphere/tree/master/skills/whizard-telemetry-ruler"},"layout":"multi","source":"github","category":"kubesphere","frontmatter":{"name":"whizard-telemetry-ruler","description":"Use when working with WizTelemetry Ruler extension for KubeSphere, including installation, configuration, alerting rules management"},"skills_sh_url":"https://skills.sh/kubesphere/kubesphere/whizard-telemetry-ruler"},"updatedAt":"2026-05-18T18:52:40.785Z"}}