01 The Kubernetes hierarchy in context
Navigate cluster, node, namespace, workload, pod, container, service and ingress relationships. Keep the workload and business-service identity connected while short-lived runtime objects are reconciled through their lifecycle.
02 Node and cluster resource health
Monitor node state, CPU, memory and capacity with the infrastructure and cloud resources beneath the cluster. Relate resource pressure and node conditions to the workloads they affect instead of assessing the host in isolation.
03 Pod and container behavior
Track restarts, pending and failed states, resource use and relevant events. Compare the current state with the incident window so a restarted or replaced pod does not erase the operational story.
04 Workload and rollout context
Bring Kubernetes, Helm/GitOps and external deployment metadata into the change timeline where supplied. Connect the rollout, revision and affected workload to errors, restarts and changing resource demand.
05 Service and ingress dependencies
Follow ingress or gateway to service, workload, pod and node, then to database, cache, queue or external API dependencies when observed. Each inferred relationship retains its source, confidence and relevant time.
06 Container logs and OpenTelemetry
Correlate structured logs, resource and service attributes, metrics and trace context with the selected workload. Bounded sampled trace evidence and service edges add detail where configured, within the same investigation and retention controls.
07 Persistent-volume and storage context
Connect persistent volumes and the relevant backing storage to the workloads that use them. Investigate a stalled or slow service alongside volume state, storage latency and node evidence to find shared constraints.
08 Process-to-network evidence
On supported Linux hosts, bounded eBPF connection telemetry relates processes, services and container workloads to remote endpoints. RTT, retransmissions and connection failures add runtime evidence while payload content remains outside this collection.
09 Capacity and dependency risk
Compare current resource use, trends and headroom across nodes, namespaces and workloads. Review deterministic capacity scenarios with visible assumptions, including the effect of losing a node or moving a workload.
10 Incident-time evidence preservation
Pin the relevant events, graph state, telemetry and changes to the incident window. Operators can compare before, during and after the problem even as the live cluster continues to change.