Analyze Top Kubernetes Warning Events with DuckDB

Extracts cluster-wide Kubernetes warning events and uses DuckDB to aggregate and rank the most frequent failure reasons.

$ kubectl get events -A --field-selector type=Warning -o json | jq -c '.items[]' | duckdb -c "SELECT involvedObject.kind, reason, count(*) as count FROM read_json_auto('/dev/stdin') GROUP BY ALL ORDER BY count DESC LIMIT 10;"

1. [01] kubectlkubectl get events -A --field-selector type=Warning -o json
   Fetches all warning events across all namespaces and outputs them as a single JSON object.
2. [02] jqjq -c '.items[]'
   Extracts the 'items' array and converts it into newline-delimited JSON (NDJSON) for efficient streaming.
3. [03] duckdbduckdb -c "SELECT involvedObject.kind, reason, count(*) as count FROM read_json_…
   Reads the NDJSON stream from stdin, groups the events by resource kind and reason, and returns the top 10 most frequent warnings.

┌──────────────────────┬─────────────────────────┬───────┐
│ involvedObject.kind  │         reason          │ count │
│       varchar        │         varchar         │ int64 │
├──────────────────────┼─────────────────────────┼───────┤
│ Pod                  │ FailedScheduling        │    42 │
│ Pod                  │ BackOff                 │    15 │
│ Deployment           │ FailedCreate            │     8 │
└──────────────────────┴─────────────────────────┴───────┘

• Requires `get events` RBAC permissions across all namespaces (due to the `-A` flag).
• Large clusters with high event churn might produce a massive JSON payload, potentially causing high memory usage in `kubectl` before the stream reaches `jq`.