Krateo incident controller: the Incident custom resource
(incidents.observability.krateo.io) and the controller, built on
provider-runtime,
that runs each incident's checks and moves it through its lifecycle.
An Incident is one occurrence of an Alert's problem. alert-provider opens it
and writes the root-cause analysis with bash scripts (precondition, apply,
verify, rollback); this controller runs precondition and verify in a read-only
sandbox and moves the incident from Open through Verifying to Resolved;
a human runs apply (and rollback to undo it) and can close the incident at any
time. A human can also ask the controller to run apply for them with an
IncidentApply: the script then runs with that user's own Kubernetes rights.
This repo holds the API (Go types, the generated CRD and its chart), the controller, its chart, and the check pod image.
Two charts, versioned from the git tag at release and published to
oci://ghcr.io/krateo-platformops/charts: incident-controller-crds (the
CRDs and the admission policy that stamps who created an IncidentApply, which
needs Kubernetes 1.36) and incident-controller (the controller). Install the CRD chart first:
helm install incident-controller-crds oci://ghcr.io/krateo-platformops/charts/incident-controller-crds --version <tag>
helm install incident-controller oci://ghcr.io/krateo-platformops/charts/incident-controller --version <tag> -n krateo-systemThe CRD chart has no values. The controller's flags, chart values, and the check pods' RBAC and network policy: configuration.
examples/incident: an Incident its verify script resolved.examples/incidentapply: one Run apply click, run as the user who made it.
- overview: the lifecycle, who writes what, the provider-runtime mapping.
- api: the CRD field by field and the rules the apiserver enforces.
- configuration: flags, chart values, what the check pods and the controller may do.
make generate # deepcopy + the CRD, from apis/ into helm/incident-controller-crds/templates
make check-generate # fail if the committed generated files are stale
make build lint test
make lint-charts # helm lint and render both charts
make check # all of the above, as CI runs it
make image image-checkChart versions are the CHART_VERSION placeholder, which the release
substitutes with the git tag.