chore(observability): vendor kubernetes-event-exporter and drop the Bitnami source

observability/base/kubernetes-event-exporter/clusterrole.yaml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubernetes-event-exporter-observability
+  labels:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+rules:
+  - apiGroups:
+      - '*'
+    resources:
+      - '*'
+    verbs:
+      - get
+      - watch
+      - list

observability/base/kubernetes-event-exporter/clusterrolebinding.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-event-exporter-observability
+  labels:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubernetes-event-exporter-observability
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-event-exporter
+    namespace: observability

observability/base/kubernetes-event-exporter/config.yaml

@@ -0,0 +1,15 @@
+clusterName: ${cluster_name}
+leaderElection: {}
+logFormat: json
+logLevel: info
+metricsNamePrefix: event_exporter_
+receivers:
+- loki:
+    streamLabels:
+      source: kubernetes-event-exporter
+    url: http://victoria-logs-victoria-logs-single-server.observability.svc.cluster.local:9428/insert/loki/api/v1/push
+  name: victorialogs
+route:
+  routes:
+  - match:
+    - receiver: victorialogs

observability/base/kubernetes-event-exporter/deployment.yaml

@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kubernetes-event-exporter
+  labels:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+    app.kubernetes.io/component: kubernetes-event-exporter
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: kubernetes-event-exporter
+      app.kubernetes.io/name: kubernetes-event-exporter
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: kubernetes-event-exporter
+        app.kubernetes.io/name: kubernetes-event-exporter
+        app.kubernetes.io/component: kubernetes-event-exporter
+    spec:
+      serviceAccountName: kubernetes-event-exporter
+      automountServiceAccountToken: true
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/instance: kubernetes-event-exporter
+                    app.kubernetes.io/name: kubernetes-event-exporter
+                    app.kubernetes.io/component: kubernetes-event-exporter
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+      securityContext:
+        fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
+      containers:
+        - name: event-exporter
+          # Renovate: kubernetes manager tracks this tag (.github/renovate.json).
+          image: ghcr.io/civitatis/kubernetes-event-exporter:1.8
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsGroup: 1001
+            runAsNonRoot: true
+            runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
+          args:
+            - -conf=/data/config.yaml
+          livenessProbe:
+            failureThreshold: 5
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            successThreshold: 1
+            timeoutSeconds: 2
+            httpGet:
+              path: /-/healthy
+              port: http
+          readinessProbe:
+            failureThreshold: 1
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            successThreshold: 1
+            timeoutSeconds: 2
+            httpGet:
+              path: /-/ready
+              port: http
+          resources:
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
+          ports:
+            - name: http
+              containerPort: 2112
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /data
+              name: cfg
+      volumes:
+        - name: cfg
+          configMap:
+            name: kubernetes-event-exporter

observability/base/kubernetes-event-exporter/kustomization.yaml

@@ -2,5 +2,35 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: observability
 resources:
-  - helmrelease.yaml
+  - serviceaccount.yaml
+  - clusterrole.yaml
+  - clusterrolebinding.yaml
+  - deployment.yaml
+  - service.yaml
+  - servicemonitor.yaml
+  - networkpolicy.yaml
+  - pdb.yaml
   - vmrule.yaml
+
+# No "dump" file receiver in config.yaml: with layout: {} (empty-but-present) the
+# fork's file sink takes the convertLayoutTemplate branch over zero keys and emits
+# contentless "{}" lines (pkg/sinks/file.go) — every cluster Event became a noise
+# line that Vector's unfiltered kubernetes_logs source re-ingested into VictoriaLogs.
+# It was never a fallback either: if the informer stops, no receiver gets anything.
+# Events flow solely via the loki receiver, targeting vlsingle (see
+# observability/base/victoria-logs/) — it pointed at the vlcluster vlinsert Service
+# (never deployed here) from 2025-08-23 to 2026-08-29, so event push silently went
+# nowhere the whole time.
+#
+# The repo's first configMapGenerator: the exporter reads -conf once at startup with
+# no file watcher, so a plain ConfigMap wouldn't roll the pod on a config change. The
+# generated name's content hash does, the same way a HelmRelease's checksum/config
+# annotation did before this was vendored (ADR-0040).
+configMapGenerator:
+  - name: kubernetes-event-exporter
+    files:
+      - config.yaml
+    options:
+      labels:
+        app.kubernetes.io/instance: kubernetes-event-exporter
+        app.kubernetes.io/name: kubernetes-event-exporter

observability/base/kubernetes-event-exporter/networkpolicy.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: kubernetes-event-exporter
+  labels:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: kubernetes-event-exporter
+      app.kubernetes.io/name: kubernetes-event-exporter
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 2112

observability/base/kubernetes-event-exporter/pdb.yaml

@@ -0,0 +1,13 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: kubernetes-event-exporter
+  labels:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: kubernetes-event-exporter
+      app.kubernetes.io/name: kubernetes-event-exporter

observability/base/kubernetes-event-exporter/service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kubernetes-event-exporter-metrics
+  labels:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+    app.kubernetes.io/component: metrics
+  annotations:
+    prometheus.io/port: "2112"
+    prometheus.io/scrape: "true"
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 2112
+      protocol: TCP
+      targetPort: http
+  selector:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+    app.kubernetes.io/component: kubernetes-event-exporter

observability/base/kubernetes-event-exporter/serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubernetes-event-exporter
+  labels:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+automountServiceAccountToken: false

observability/base/kubernetes-event-exporter/servicemonitor.yaml

@@ -0,0 +1,21 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: kubernetes-event-exporter
+  labels:
+    app.kubernetes.io/instance: kubernetes-event-exporter
+    app.kubernetes.io/name: kubernetes-event-exporter
+    app.kubernetes.io/component: kubernetes-event-exporter
+spec:
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: 30s
+  namespaceSelector:
+    matchNames:
+      - observability
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: kubernetes-event-exporter
+      app.kubernetes.io/name: kubernetes-event-exporter
+      app.kubernetes.io/component: metrics