v1.10.0 — Workload-Scoped Incidents
v1.10.0 — Workload-Scoped Incidents
The Investigation and Incidents pages no longer anchor on the Pod — the most ephemeral object in Kubernetes — they anchor on the workload that actually owns the problem.
The problem this fixes
A 5-minute-old pod could display a 26-day-old incident timeline. The underlying tracking was correct (an incident should persist across pod replacements — that's what makes it memory), but the presentation wasn't: AGE: 0d sitting beside FIRST DETECTED: 26 days ago read as a contradiction, not as "this Deployment has been unstable for weeks across several pod replacements."
What's new
Deterministic focus selection. When multiple pods briefly match the same incident fingerprint (a pod mid-termination alongside its replacement), OpsCart now selects one canonical Focus Pod — highest restart count wins, pod name breaks ties — instead of the previous arbitrary, scan-order-dependent choice.
Cross-pod contamination fixed. Restart-milestone and drift comparisons now check whether the Focus Pod actually stayed the same between scans. Previously, a pod replacement (249 restarts → 2 restarts) could be misread as a trend on the same object; now a resource change correctly resets the comparison instead of producing a false signal.
Workload-first Incidents table. The Incident column is now Workload, showing the owning Deployment/StatefulSet/DaemonSet as the primary identity with the current pod as a secondary line — matching what the Investigation page shows when you click through.
Investigation page redesign:
Situation Briefing — observational only, no causal claims ("has been observed in a critical state since Jul 10," not "root cause is X" or "never resolved")
Operational Identity card — Classification, Severity, Tracking scope (accurately labeled per controller type: Deployment-wide, StatefulSet-instance-scoped, etc.), Open Since
Current Observation card — Namespace, Workload, Focus Pod, Pod Age, Restart Count, Container, live status, with a ready-to-copy kubectl describe command
Namespace-scoped findings (missing NetworkPolicy, idle namespaces) preserved exactly as before — no pod-shaped data forced onto them
Removed the raw timeline event count, since it was inflated by a still-open flapping investigation — no numbers shown that aren't currently trustworthy
Fixed: Incidents and War Room links no longer pass a synthetic pod parameter for namespace-level findings, and no longer leak the internal current-context placeholder into shareable URLs.
Not in this release
Recurrence statistics (recovered/reopened counts) and pod-replacement timeline events are intentionally held back until an ongoing flapping investigation is resolved — shipping derived stats on top of unverified data would be worse than not shipping them at all.