fix(observability): retain delayed Kubernetes events

scripts/reboot-recovery/tests/test_event_exporter_metadata_rbac.py

@@ -9,31 +9,24 @@ ROOT = Path(__file__).resolve().parents[3]
 MANIFEST = ROOT / "k8s" / "observability" / "event-exporter.yaml"
 
 
-def test_event_exporter_has_minimal_metadata_enrichment_reads() -> None:
+def test_event_exporter_watches_only_events_and_namespaces() -> None:
     documents = [
         doc for doc in yaml.safe_load_all(MANIFEST.read_text(encoding="utf-8")) if doc
     ]
     role = next(doc for doc in documents if doc["kind"] == "ClusterRole")
     rules = role["rules"]
-
-    expected = {
-        ("", "pods"),
-        ("apps", "deployments"),
-        ("apps", "replicasets"),
-        ("apps", "daemonsets"),
-        ("batch", "jobs"),
-        ("batch", "cronjobs"),
-        ("argoproj.io", "applications"),
-    }
-    granted = {
-        (api_group, resource)
-        for rule in rules
-        for api_group in rule["apiGroups"]
-        for resource in rule["resources"]
-        if rule["verbs"] == ["get"]
-    }
-    assert expected <= granted
-    assert all(resource not in {"secrets", "configmaps"} for _, resource in granted)
+    assert rules == [
+        {
+            "apiGroups": [""],
+            "resources": ["events"],
+            "verbs": ["get", "watch", "list"],
+        },
+        {
+            "apiGroups": [""],
+            "resources": ["namespaces"],
+            "verbs": ["get", "watch", "list"],
+        },
+    ]
 
 
 def test_event_exporter_metadata_rules_never_write_or_delete() -> None:
@@ -89,3 +82,9 @@ def test_event_exporter_has_one_route_and_drops_only_known_normal_noise() -> Non
         "Created",
         "Started",
     }
+
+
+def test_event_exporter_keeps_late_events_without_object_lookups() -> None:
+    config = _event_exporter_config()
+    assert config["omitLookup"] is True
+    assert config["maxEventAgeSeconds"] == 120