How collection works

Kollect registers shared dynamic informers for the GVKs declared by active profiles. Events pass through namespace, watch-mode, label, and field filters before JSONPath or CEL extraction produces deterministically ordered rows.

flowchart LR
  A["Kubernetes watch event"] --> F["Scope and selector filters"]
  F --> E["JSONPath / CEL extraction"]
  E --> C["In-memory inventory snapshot"]

The operator is level-based: a reconcile recomputes desired state from observed state, while a long resync is only a correctness backstop. Missing optional attributes are omitted; required extraction failures surface in target conditions, events and status.lastExtractionError. Those messages name the attribute and an error class (no such key, invalid timestamp, filter applied to a non-list value, …), never the evaluated field values, because anyone who can read the target can read them. CEL compile and JSONPath parse errors keep their full detail.

Filters are cumulative: the operator watch boundary, scope policy, target namespace and label selectors, resource rules, CEL match policy, and watch labels must all permit an object. Targets sharing a GVK reuse one informer, so adding a selector does not add another API-server watch.

JSONPath wildcards produce lists; CEL can compute typed values. Extracted rows enter the namespace inventory store with stable identity and ordering before export sees them.

See ADR-0301, ADR-0302, and annotations and labels.