@oneuptime/common 12.0.25 → 12.0.26

package/Server/Services/HostService.ts

@@ -3,7 +3,14 @@ import HostLabelRuleEngineService from "./HostLabelRuleEngineService";
 import HostOwnerRuleEngineService from "./HostOwnerRuleEngineService";
 import Model from "../../Models/DatabaseModels/Host";
 import Label from "../../Models/DatabaseModels/Label";
-import { OnCreate } from "../Types/Database/Hooks";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import HostFeedService from "./HostFeedService";
+import { HostFeedEventType } from "../../Models/DatabaseModels/HostFeed";
+import ResourceFeedUtil from "../Utils/ResourceFeed/ResourceFeedUtil";
+import { Blue500, Gray500, Green500, Yellow500 } from "../../Types/BrandColors";
+import { JSONObject } from "../../Types/JSON";
+import URL from "../../Types/API/URL";
+import DatabaseConfig from "../DatabaseConfig";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import ResourceHeartbeat from "../Utils/Telemetry/ResourceHeartbeat";
 import ObjectID from "../../Types/ObjectID";
@@ -69,7 +76,7 @@ export class Service extends DatabaseService<Model> {
 
   @CaptureSpan()
   protected override async onCreateSuccess(
-    _onCreate: OnCreate<Model>,
+    onCreate: OnCreate<Model>,
     createdItem: Model,
   ): Promise<Model> {
     if (createdItem.projectId && createdItem.id) {
@@ -95,6 +102,16 @@ export class Service extends DatabaseService<Model> {
           );
         });
     }
+    /*
+     * The overview page can say what this host looks like now; only
+     * the feed can say why it exists at all - whether a person added it or
+     * ingest registered it the first time telemetry named it. Fire and
+     * forget: a feed write must never fail the create it describes.
+     */
+    this.writeHostCreatedFeed(createdItem, onCreate).catch((error: Error) => {
+      logger.error(error);
+    });
+
     return createdItem;
   }
 
@@ -629,6 +646,202 @@ export class Service extends DatabaseService<Model> {
     }
     return identifiers;
   }
+
+  /**
+   * Display name for this host, or an empty string when the row is
+   * gone. Feed writers call this on a best-effort basis, so a missing row must
+   * not throw and take the surrounding write down with it.
+   */
+  @CaptureSpan()
+  public async getHostName(data: { hostId: ObjectID }): Promise<string> {
+    const host: Model | null = await this.findOneById({
+      id: data.hostId,
+      select: {
+        name: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return host?.name || "";
+  }
+
+  @CaptureSpan()
+  public async getHostLinkInDashboard(
+    projectId: ObjectID,
+    hostId: ObjectID,
+  ): Promise<URL> {
+    const dashboardUrl: URL = await DatabaseConfig.getDashboardUrl();
+
+    return URL.fromString(dashboardUrl.toString()).addRoute(
+      `/${projectId.toString()}/host/${hostId.toString()}`,
+    );
+  }
+
+  /**
+   * "[Host prod-1](https://…)" - the form every feed item uses to
+   * name the resource it is about.
+   */
+  @CaptureSpan()
+  public async getHostMarkdownLink(
+    projectId: ObjectID,
+    hostId: ObjectID,
+  ): Promise<string> {
+    const name: string = await this.getHostName({ hostId: hostId });
+    const link: URL = await this.getHostLinkInDashboard(projectId, hostId);
+
+    return `[Host ${name}](${link.toString()})`;
+  }
+
+  private async writeHostCreatedFeed(
+    createdItem: Model,
+    onCreate: OnCreate<Model>,
+  ): Promise<void> {
+    const projectId: ObjectID | undefined = createdItem.projectId;
+    const hostId: ObjectID | undefined = createdItem.id || undefined;
+
+    if (!projectId || !hostId) {
+      return;
+    }
+
+    /*
+     * Ingest creates these rows with root props and no acting user; every
+     * dashboard, API and Terraform create carries one. That is the whole
+     * signal for "was this discovered automatically or added by a person".
+     */
+    const createdByUserId: ObjectID | undefined =
+      createdItem.createdByUserId ||
+      onCreate.createBy.props.userId ||
+      undefined;
+
+    const markdown: {
+      feedInfoInMarkdown: string;
+      moreInformationInMarkdown: string;
+    } = await ResourceFeedUtil.getCreatedFeedMarkdown({
+      resourceTypeName: "host",
+      resourceMarkdownLink: await this.getHostMarkdownLink(projectId, hostId),
+      projectId: projectId,
+      createdByUserId: createdByUserId,
+      identifierName: "Host identifier",
+      identifierValue: createdItem.hostIdentifier,
+      description: createdItem.description,
+    });
+
+    await HostFeedService.createHostFeedItem({
+      hostId: hostId,
+      projectId: projectId,
+      hostFeedEventType: HostFeedEventType.HostCreated,
+      displayColor: Green500,
+      feedInfoInMarkdown: markdown.feedInfoInMarkdown,
+      moreInformationInMarkdown: markdown.moreInformationInMarkdown,
+      userId: createdByUserId,
+    });
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    this.writeHostUpdatedFeed(onUpdate, updatedItemIds).catch(
+      (error: Error) => {
+        logger.error(error);
+      },
+    );
+
+    return onUpdate;
+  }
+
+  private async writeHostUpdatedFeed(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<void> {
+    const updateData: JSONObject = onUpdate.updateBy
+      .data as unknown as JSONObject;
+
+    /*
+     * Heartbeats update lastSeenAt / otelCollectorStatus / agentVersion and the
+     * rollup counters constantly. Only the columns a person would recognise as
+     * a change earn a feed item - see MEANINGFUL_UPDATE_COLUMNS.
+     */
+    const changedColumns: Array<string> =
+      ResourceFeedUtil.getUpdatedColumnsWorthRecording(updateData);
+
+    if (changedColumns.length === 0 || updatedItemIds.length === 0) {
+      return;
+    }
+
+    const isArchiveChange: boolean =
+      ResourceFeedUtil.isArchiveChange(updateData);
+    const isArchived: boolean = Boolean(updateData["isArchived"]);
+    const otherColumns: Array<string> = changedColumns.filter(
+      (column: string) => {
+        return column !== "isArchived";
+      },
+    );
+
+    const updatedByUserId: ObjectID | undefined =
+      onUpdate.updateBy.props.userId || undefined;
+
+    for (const hostId of updatedItemIds) {
+      const host: Model | null = await this.findOneById({
+        id: hostId,
+        select: {
+          projectId: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+      const projectId: ObjectID | undefined = host?.projectId;
+
+      if (!projectId) {
+        continue;
+      }
+
+      const resourceMarkdownLink: string = await this.getHostMarkdownLink(
+        projectId,
+        hostId,
+      );
+
+      if (isArchiveChange) {
+        await HostFeedService.createHostFeedItem({
+          hostId: hostId,
+          projectId: projectId,
+          hostFeedEventType: isArchived
+            ? HostFeedEventType.HostArchived
+            : HostFeedEventType.HostRestored,
+          displayColor: isArchived ? Yellow500 : Blue500,
+          feedInfoInMarkdown: isArchived
+            ? `🗄️ ${resourceMarkdownLink} was archived.`
+            : `♻️ ${resourceMarkdownLink} was restored from the archive.`,
+          userId: updatedByUserId,
+        });
+      }
+
+      if (otherColumns.length > 0) {
+        const markdown: {
+          feedInfoInMarkdown: string;
+          moreInformationInMarkdown: string;
+        } = ResourceFeedUtil.getUpdatedFeedMarkdown({
+          resourceMarkdownLink: resourceMarkdownLink,
+          columns: otherColumns,
+        });
+
+        await HostFeedService.createHostFeedItem({
+          hostId: hostId,
+          projectId: projectId,
+          hostFeedEventType: HostFeedEventType.HostUpdated,
+          displayColor: Gray500,
+          feedInfoInMarkdown: markdown.feedInfoInMarkdown,
+          moreInformationInMarkdown: markdown.moreInformationInMarkdown,
+          userId: updatedByUserId,
+        });
+      }
+    }
+  }
 }
 
 function fingerprintLabelIds(labelIds: Array<ObjectID>): string {

package/Server/Services/IncidentService.ts

@@ -3872,6 +3872,17 @@ ${incidentSeverity.name}
       throw new BadDataException("Incident not found");
     }
 
+    /*
+     * The project's AI kill switch, at the service layer rather than only on
+     * the HTTP handler above it. This method is public and has a second
+     * caller (IncidentPostmortemRunner), so gating the route alone would
+     * leave the switch true for one entry point and false for the other.
+     * Checking here also refuses BEFORE the context builder below, which
+     * reads the whole incident dossier — private notes, workspace messages —
+     * to assemble a prompt this project has said it does not want sent.
+     */
+    await AIService.assertProjectAIEnabled(incident.projectId);
+
     // Build incident context - always include workspace messages
     const contextData: IncidentContextData =
       await IncidentAIContextBuilder.buildIncidentContext({

package/Server/Services/Index.ts

@@ -135,6 +135,15 @@ import AIInsightService from "./AIInsightService";
 // Monitors
 import MonitorService from "./MonitorService";
 import MonitorFeedService from "./MonitorFeedService";
+import KubernetesClusterFeedService from "./KubernetesClusterFeedService";
+import DockerHostFeedService from "./DockerHostFeedService";
+import DockerSwarmClusterFeedService from "./DockerSwarmClusterFeedService";
+import CephClusterFeedService from "./CephClusterFeedService";
+import PodmanHostFeedService from "./PodmanHostFeedService";
+import ProxmoxClusterFeedService from "./ProxmoxClusterFeedService";
+import HostFeedService from "./HostFeedService";
+import CloudResourceFeedService from "./CloudResourceFeedService";
+import ServiceFeedService from "./ServiceFeedService";
 import MonitorStatusService from "./MonitorStatusService";
 import MonitorStatusTimelineService from "./MonitorStatusTimelineService";
 import NotificationService from "./NotificationService";
@@ -283,6 +292,7 @@ import WorkflowService from "./WorkflowService";
 import WorkflowVariablesService from "./WorkflowVariableService";
 import AnalyticsBaseModel from "../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
 import TelemetryExceptionService from "./TelemetryExceptionService";
+import TelemetrySourceMapService from "./TelemetrySourceMapService";
 import InventoryItemService from "./InventoryItemService";
 import InventoryItemCustomFieldService from "./InventoryItemCustomFieldService";
 import InventoryItemRelationshipService from "./InventoryItemRelationshipService";
@@ -307,6 +317,8 @@ import AlertOwnerUserService from "./AlertOwnerUserService";
 import AlertSeverityService from "./AlertSeverityService";
 import DetectionRuleService from "./DetectionRuleService";
 import GoogleSecOpsConnectionService from "./GoogleSecOpsConnectionService";
+import ThreatIntelFeedService from "./ThreatIntelFeedService";
+import ThreatIntelIndicatorService from "./ThreatIntelIndicatorService";
 import AlertNoteTemplateService from "./AlertNoteTemplateService";
 
 // AlertEpisode Services
@@ -545,6 +557,15 @@ const services: Array<BaseService> = [
   RunbookSecretService,
   AIInsightService,
   MonitorFeedService,
+  KubernetesClusterFeedService,
+  DockerHostFeedService,
+  DockerSwarmClusterFeedService,
+  CephClusterFeedService,
+  PodmanHostFeedService,
+  ProxmoxClusterFeedService,
+  HostFeedService,
+  CloudResourceFeedService,
+  ServiceFeedService,
 
   NotificationService,
 
@@ -681,6 +702,7 @@ const services: Array<BaseService> = [
   ServiceOwnerUserService,
 
   TelemetryExceptionService,
+  TelemetrySourceMapService,
   InventoryItemService,
   InventoryItemCustomFieldService,
   InventoryItemRelationshipService,
@@ -704,6 +726,7 @@ const services: Array<BaseService> = [
   AlertSeverityService,
   DetectionRuleService,
   GoogleSecOpsConnectionService,
+  ThreatIntelFeedService,
   AlertNoteTemplateService,
   AlertFeedService,
 
@@ -851,6 +874,7 @@ export const AnalyticsServices: Array<
   RumSessionChunkService,
   AuditLogService,
   SecurityEventService,
+  ThreatIntelIndicatorService,
   ChangeEventService,
 ];
 

package/Server/Services/KubernetesClusterFeedService.ts

@@ -0,0 +1,99 @@
+import { Blue500 } from "../../Types/BrandColors";
+import Color from "../../Types/Color";
+import OneUptimeDate from "../../Types/Date";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import { IsBillingEnabled } from "../EnvironmentConfig";
+import logger, { LogAttributes } from "../Utils/Logger";
+import DatabaseService from "./DatabaseService";
+import KubernetesClusterFeed, {
+  KubernetesClusterFeedEventType,
+} from "../../Models/DatabaseModels/KubernetesClusterFeed";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+export class Service extends DatabaseService<KubernetesClusterFeed> {
+  public constructor() {
+    super(KubernetesClusterFeed);
+
+    if (IsBillingEnabled) {
+      this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365); // 3 years
+    }
+  }
+
+  @CaptureSpan()
+  public async createKubernetesClusterFeedItem(data: {
+    kubernetesClusterId: ObjectID;
+    feedInfoInMarkdown: string;
+    kubernetesClusterFeedEventType: KubernetesClusterFeedEventType;
+    projectId: ObjectID;
+    moreInformationInMarkdown?: string | undefined;
+    displayColor?: Color | undefined;
+    userId?: ObjectID | undefined;
+    postedAt?: Date | undefined;
+  }): Promise<void> {
+    /*
+     * A feed item is a side effect of the thing that actually happened. It must
+     * never be able to fail the write it is describing, so everything here is
+     * swallowed and logged rather than thrown - same contract as
+     * MonitorFeedService.
+     */
+    try {
+      const feed: KubernetesClusterFeed = new KubernetesClusterFeed();
+
+      if (!data.kubernetesClusterId) {
+        throw new BadDataException("Kubernetes Cluster ID is required");
+      }
+
+      if (!data.feedInfoInMarkdown) {
+        throw new BadDataException("Log in markdown is required");
+      }
+
+      if (!data.kubernetesClusterFeedEventType) {
+        throw new BadDataException("Kubernetes Cluster feed event is required");
+      }
+
+      if (!data.projectId) {
+        throw new BadDataException("Project ID is required");
+      }
+
+      if (!data.displayColor) {
+        data.displayColor = Blue500;
+      }
+
+      feed.displayColor = data.displayColor;
+      feed.kubernetesClusterId = data.kubernetesClusterId;
+      feed.feedInfoInMarkdown = data.feedInfoInMarkdown;
+      feed.kubernetesClusterFeedEventType = data.kubernetesClusterFeedEventType;
+      feed.projectId = data.projectId;
+      feed.postedAt = data.postedAt || OneUptimeDate.getCurrentDate();
+
+      if (data.userId) {
+        feed.userId = data.userId;
+      }
+
+      if (data.moreInformationInMarkdown) {
+        feed.moreInformationInMarkdown = data.moreInformationInMarkdown;
+      }
+
+      await this.create({
+        data: feed,
+        props: {
+          isRoot: true,
+        },
+      });
+    } catch (e) {
+      logger.error("Error in creating Kubernetes cluster feed", {
+        projectId: data.projectId?.toString(),
+        kubernetesClusterId: data.kubernetesClusterId?.toString(),
+      } as LogAttributes);
+      logger.error(e, {
+        projectId: data.projectId?.toString(),
+        kubernetesClusterId: data.kubernetesClusterId?.toString(),
+      } as LogAttributes);
+
+      // we dont throw this error as it is not a critical error
+    }
+  }
+}
+
+export default new Service();

package/Server/Services/KubernetesClusterLabelRuleEngineService.ts

@@ -3,6 +3,9 @@ import KubernetesCluster from "../../Models/DatabaseModels/KubernetesCluster";
 import KubernetesClusterLabelRule from "../../Models/DatabaseModels/KubernetesClusterLabelRule";
 import KubernetesClusterLabelRuleService from "./KubernetesClusterLabelRuleService";
 import KubernetesClusterService from "./KubernetesClusterService";
+import KubernetesClusterFeedService from "./KubernetesClusterFeedService";
+import { KubernetesClusterFeedEventType } from "../../Models/DatabaseModels/KubernetesClusterFeed";
+import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -61,6 +64,7 @@ class KubernetesClusterLabelRuleEngineServiceClass {
       }
 
       const labelIdsToAdd: Set<string> = new Set();
+      const matchedRuleNames: Array<string> = [];
 
       for (const rule of rules) {
         const matches: boolean = this.doesKubernetesClusterMatchRule(
@@ -70,6 +74,11 @@ class KubernetesClusterLabelRuleEngineServiceClass {
         if (!matches) {
           continue;
         }
+        if ((rule.labelsToAdd || []).length > 0) {
+          matchedRuleNames.push(
+            rule.name || rule.id?.toString() || "Unnamed rule",
+          );
+        }
         for (const label of rule.labelsToAdd || []) {
           if (label.id) {
             labelIdsToAdd.add(label.id.toString());
@@ -126,6 +135,27 @@ class KubernetesClusterLabelRuleEngineServiceClass {
         `KubernetesClusterLabelRuleEngine attached ${newLabelIds.length} labels to Kubernetes cluster ${kubernetesCluster.id}`,
         { projectId: kubernetesCluster.projectId.toString() } as LogAttributes,
       );
+      /*
+       * Labels arriving from a rule rather than from a person is exactly the
+       * kind of thing the overview page cannot explain, so record which rules
+       * did it.
+       */
+      await KubernetesClusterFeedService.createKubernetesClusterFeedItem({
+        kubernetesClusterId: kubernetesCluster.id,
+        projectId: kubernetesCluster.projectId,
+        kubernetesClusterFeedEventType:
+          KubernetesClusterFeedEventType.LabelRuleExecuted,
+        displayColor: Purple500,
+        feedInfoInMarkdown: `🏷️ ${newLabelIds.length} label(s) were attached to ${await KubernetesClusterService.getKubernetesClusterMarkdownLink(
+          kubernetesCluster.projectId,
+          kubernetesCluster.id,
+        )} by label ${matchedRuleNames.length === 1 ? "rule" : "rules"}.`,
+        moreInformationInMarkdown: `**Label rules that matched**: ${matchedRuleNames
+          .map((name: string) => {
+            return `\`${name}\``;
+          })
+          .join(", ")}`,
+      });
     } catch (error) {
       logger.error(`Error applying Kubernetes cluster label rules: ${error}`, {
         projectId: kubernetesCluster.projectId?.toString(),

package/Server/Services/KubernetesClusterOwnerRuleEngineService.ts

@@ -7,6 +7,9 @@ import KubernetesClusterOwnerRuleService from "./KubernetesClusterOwnerRuleServi
 import KubernetesClusterOwnerUserService from "./KubernetesClusterOwnerUserService";
 import KubernetesClusterOwnerTeamService from "./KubernetesClusterOwnerTeamService";
 import KubernetesClusterService from "./KubernetesClusterService";
+import KubernetesClusterFeedService from "./KubernetesClusterFeedService";
+import { KubernetesClusterFeedEventType } from "../../Models/DatabaseModels/KubernetesClusterFeed";
+import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -144,6 +147,27 @@ class KubernetesClusterOwnerRuleEngineServiceClass {
         `KubernetesClusterOwnerRuleEngine added owners to Kubernetes cluster ${kubernetesCluster.id}`,
         { projectId: kubernetesCluster.projectId.toString() } as LogAttributes,
       );
+      /*
+       * The individual OwnerUserAdded / OwnerTeamAdded items say who was added;
+       * this one says which rule is responsible, which is what somebody asking
+       * "why am I on the hook for this?" actually needs.
+       */
+      await KubernetesClusterFeedService.createKubernetesClusterFeedItem({
+        kubernetesClusterId: kubernetesCluster.id,
+        projectId: kubernetesCluster.projectId,
+        kubernetesClusterFeedEventType:
+          KubernetesClusterFeedEventType.OwnerRuleExecuted,
+        displayColor: Purple500,
+        feedInfoInMarkdown: `👥 Owners were added to ${await KubernetesClusterService.getKubernetesClusterMarkdownLink(
+          kubernetesCluster.projectId,
+          kubernetesCluster.id,
+        )} by ${matchedRules.length} owner ${matchedRules.length === 1 ? "rule" : "rules"}.`,
+        moreInformationInMarkdown: `**Owner rules that matched**: ${matchedRules
+          .map((rule: KubernetesClusterOwnerRule) => {
+            return `\`${rule.name || rule.id?.toString() || "Unnamed rule"}\``;
+          })
+          .join(", ")}`,
+      });
     } catch (error) {
       logger.error(`Error applying Kubernetes cluster owner rules: ${error}`, {
         projectId: kubernetesCluster.projectId?.toString(),

package/Server/Services/KubernetesClusterOwnerTeamService.ts

@@ -1,10 +1,143 @@
+import ObjectID from "../../Types/ObjectID";
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/KubernetesClusterOwnerTeam";
+import KubernetesClusterFeedService from "./KubernetesClusterFeedService";
+import { KubernetesClusterFeedEventType } from "../../Models/DatabaseModels/KubernetesClusterFeed";
+import { Gray500, Red500 } from "../../Types/BrandColors";
+import Team from "../../Models/DatabaseModels/Team";
+import TeamService from "./TeamService";
+import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import DeleteBy from "../Types/Database/DeleteBy";
+import KubernetesClusterService from "./KubernetesClusterService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    /*
+     * The rows are gone by the time onDeleteSuccess runs, so the feed item has
+     * to be built from what was read here.
+     */
+    const itemsToDelete: Array<Model> = await this.findBy({
+      query: deleteBy.query,
+      limit: deleteBy.limit,
+      skip: deleteBy.skip,
+      props: {
+        isRoot: true,
+      },
+      select: {
+        kubernetesClusterId: true,
+        projectId: true,
+        teamId: true,
+      },
+    });
+
+    return {
+      carryForward: {
+        itemsToDelete: itemsToDelete,
+      },
+      deleteBy: deleteBy,
+    };
+  }
+
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<Model>,
+    _itemIdsBeforeDelete: Array<ObjectID>,
+  ): Promise<OnDelete<Model>> {
+    const deletedByUserId: ObjectID | undefined =
+      onDelete.deleteBy.deletedByUser?.id || onDelete.deleteBy.props.userId;
+
+    const itemsToDelete: Array<Model> = onDelete.carryForward.itemsToDelete;
+
+    for (const item of itemsToDelete) {
+      const kubernetesClusterId: ObjectID | undefined =
+        item.kubernetesClusterId;
+      const projectId: ObjectID | undefined = item.projectId;
+      const teamId: ObjectID | undefined = item.teamId;
+
+      if (!kubernetesClusterId || !projectId || !teamId) {
+        continue;
+      }
+
+      const team: Team | null = await TeamService.findOneById({
+        id: teamId,
+        select: {
+          name: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+      if (!team || !team.name) {
+        continue;
+      }
+
+      await KubernetesClusterFeedService.createKubernetesClusterFeedItem({
+        kubernetesClusterId: kubernetesClusterId,
+        projectId: projectId,
+        kubernetesClusterFeedEventType:
+          KubernetesClusterFeedEventType.OwnerTeamRemoved,
+        displayColor: Red500,
+        feedInfoInMarkdown: `👨🏻‍👩🏻‍👦🏻 Removed team **${team.name}** as an owner of ${await KubernetesClusterService.getKubernetesClusterMarkdownLink(
+          projectId,
+          kubernetesClusterId,
+        )}.`,
+        userId: deletedByUserId || undefined,
+      });
+    }
+
+    return onDelete;
+  }
+
+  @CaptureSpan()
+  public override async onCreateSuccess(
+    onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    const kubernetesClusterId: ObjectID | undefined =
+      createdItem.kubernetesClusterId;
+    const projectId: ObjectID | undefined = createdItem.projectId;
+    const teamId: ObjectID | undefined = createdItem.teamId;
+    const createdByUserId: ObjectID | undefined =
+      createdItem.createdByUserId || onCreate.createBy.props.userId;
+
+    if (kubernetesClusterId && teamId && projectId) {
+      const team: Team | null = await TeamService.findOneById({
+        id: teamId,
+        select: {
+          name: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+      if (team && team.name) {
+        await KubernetesClusterFeedService.createKubernetesClusterFeedItem({
+          kubernetesClusterId: kubernetesClusterId,
+          projectId: projectId,
+          kubernetesClusterFeedEventType:
+            KubernetesClusterFeedEventType.OwnerTeamAdded,
+          displayColor: Gray500,
+          feedInfoInMarkdown: `👨🏻‍👩🏻‍👦🏻 Added team **${team.name}** as an owner of ${await KubernetesClusterService.getKubernetesClusterMarkdownLink(
+            projectId,
+            kubernetesClusterId,
+          )}.`,
+          userId: createdByUserId || undefined,
+        });
+      }
+    }
+
+    return createdItem;
+  }
 }
 
 export default new Service();