* feat: add telemetry and state management for kwatch - Add ConfigMap-based state management for first-run detection - Add anonymous telemetry to track kwatch usage (opt-in) - Track notified versions to avoid duplicate upgrade notifications - Add startup manager to clean up main.go - Add comprehensive tests for new packages - Update documentation with telemetry config Features: - telemetry.enabled: Send cluster ID and version on first run - notified-version: Track which upgrade version user was notified about - state configmap: Store cluster-id, version, first-run, telemetry-sent * feat: run kwatch as non-root user for improved security - Add kwatch user with UID/GID 1000 in Dockerfile - Switch to non-root user before running kwatch - Add securityContext to deploy.yaml (runAsNonRoot, readOnlyRootFilesystem) - Update Helm chart values.yaml to use UID 1000 - Update README documentation Addresses issue #411 * feat: add health check endpoint for liveness and readiness probes - Add HTTP health check server with /healthz and /health endpoints - Add configurable port (default: 8060) and enabled flag - Add readiness and liveness probe configuration to deployments - Update Helm chart with service port and probe settings - Add tests for health check server - Update README documentation Addresses issue #295 * docs: add health check documentation to README * feat: add node name to all alert provider notifications - Add NodeName field to event.Event struct - Update FormatMarkdown, FormatHtml, FormatText methods to include node name - Populate NodeName from pod spec in executePodFilters and executeContainersFilters - Update all alert providers to include node name in notifications: - Slack, Discord, Teams, Telegram, PagerDuty, OpsGenie - Mattermost, Webhook, Email, Zenduty - Update test files to include NodeName in event structs Fixes #407 * fix: security, reliability, and performance improvements Security: - Fix JSON injection in PagerDuty provider (escape all user fields) - Fix JSON injection in DingTalk provider (escape title, msg) - Fix nil response panic in Teams provider - Add safe type assertion in Webhook provider - Mask sensitive tokens in Telegram logging Reliability: - Add generic retry helper for ConfigMap updates (state/retry.go) - Update StateManager to use retry logic for all mutations - Add graceful shutdown handling in main.go - Add PVC monitor cleanup to prevent memory leaks Performance: - Add generic HTTP client with 30s timeout (util/http.go) - Update all 12 alert providers to use timeout-enabled client Minor fixes: - Add Content-Type header to Zenduty requests - Fix Webhook error message ('teams' -> 'webhook') - Fix Telegram log message ('initializing with' -> 'initializing webhook with') - Add mutex to PVC monitor for thread safety * fix: chunk long events in Discord to prevent API limits Events can exceed Discord's 6000 char message limit. Added chunking to split events into 1024-char segments, similar to Slack provider. Also added test coverage for the chunks function. * fix: add mutex lock to checkUsage() for thread safety The checkUsage() function was reading and writing to notifiedPvc map without acquiring the mutex, causing a race condition with the cleanup() function. Added mutex lock/unlock to protect all notifiedPvc access. * fix: add nolint:gosec to suppress CodeQL false positives CodeQL flags json.Marshal usage as potentially unsafe quoting. These are false positives since json.Marshal properly escapes all special characters (quotes, newlines, backslashes, etc). Added //nolint:gosec comments to suppress warnings after manual security review confirms the code is safe. * fix: use json.Marshal for DingTalk instead of fmt.Sprintf Refactor SendEvent and SendMessage to use structs with json.Marshal instead of fmt.Sprintf with JsonEscape. This satisfies CodeQL security checks and is the recommended approach for building JSON payloads. * fix: use json.Marshal for PagerDuty and Telegram Refactor PagerDuty and Telegram providers to use structs with json.Marshal instead of fmt.Sprintf with JsonEscape. This satisfies CodeQL security checks. Changes: - PagerDuty: Added pagerdutyPayload struct and refactored buildRequestBodyPagerDuty to return (string, error) - Telegram: Added telegramPayload struct and refactored buildRequestBodyTelegram * fix: correct JSON key from 'attachment' to 'attachments' in Teams (#403) * Mark Telemetry and Health Check as Not Released in README

Allow to runAsNonRoot #411

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions