Kubernetes EndpointSlice Ready Endpoints Depletion and Routing Sentinel

id: kubernetes-endpointslice-depletion-sentinel
namespace: company.sre

inputs:
  - id: kube_context
    type: STRING
    required: false
    description: Optional Kubernetes context name.
  - id: empty_slice_threshold
    type: INT
    defaults: 0
    description: Maximum acceptable count of EndpointSlices with zero ready endpoints.

tasks:
  - id: audit_endpointslices
    type: io.kestra.plugin.scripts.shell.Commands
    containerImage: bitnami/kubectl:latest
    commands:
      - |
        CONTEXT_ARG=""
        if [ -n "{{ inputs.kube_context }}" ]; then
          CONTEXT_ARG="--context={{ inputs.kube_context }}"
        fi

        kubectl $CONTEXT_ARG get endpointslices -A -o json > /tmp/eps_all.json

        EMPTY_SLICES=$(jq '[.items[] | select((.endpoints // []) | map(select(.conditions.ready == true)) | length == 0) | {namespace: .metadata.namespace, name: .metadata.name, service: .metadata.labels."kubernetes.io/service-name", address_type: .addressType}]' /tmp/eps_all.json)
        EMPTY_COUNT=$(echo "$EMPTY_SLICES" | jq 'length')

        echo "::set-output name=empty_count::$EMPTY_COUNT::"
        echo "::set-output name=empty_slices::$EMPTY_SLICES::"

  - id: evaluate_endpointslice_health
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.audit_endpointslices.vars.empty_count | int >
      inputs.empty_slice_threshold }}"
    then:
      - id: notify_platform_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#infrastructure-alerts",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 Kubernetes EndpointSlice Ready Endpoints Depletion Alert",
                "text": "Detected *{{ outputs.audit_endpointslices.vars.empty_count }}* EndpointSlice(s) with *zero ready backend endpoints*. Depleted slices: {{ outputs.audit_endpointslices.vars.empty_slices }}. Impact: Traffic routed to these services will fail with connection refused or 503 Service Unavailable, breaking inter-pod networking.",
                "footer": "Kestra SRE Sentinel • EndpointSlice Health"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#infrastructure-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ EndpointSlice Sentinel Execution Failed",
            "text": "The Kubernetes EndpointSlice audit workflow encountered an execution error. Please check cluster RBAC permissions and API reachability.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true